How to check if the user is "Admin"

Question

I am developing a website using ASP.NET 4.0 and SQL Server 2008.In Login Page, I have to check the user vendor ID and according to the vendor ID the page is redirected to different page.Everything working good but I don't know how to check when the admin enter his VendorID and Password so that the admin page is redirect.His Vendor ID and Password also stored in the same table "User_Info" with the other users.Refer the below code, It is always redirected to the admin page only because i gave the his vendorID and password directly in the code.Please give your suggestions to overcome this problem.

    protected void BtnHomeUserSubmit_Click(object sender, EventArgs e)
     {
      SqlConnection SqlCon = new SqlConnection(GetConnectionString());
      try
      {          
       var da1 = new SqlDataAdapter("select * from User_Info where Vendor_ID='" + txtHomeUsername.Text.Trim() + "' AND User_Password='" + txtHomePassword.Text.Trim() + "'", SqlCon);
           var dt1 = new DataTable();
           da1.Fill(dt1);
           if (dt1.Rows.Count == 0)
           {
            ScriptManager.RegisterStartupScript(this, this.GetType(), "Alert", "alert('Enter valid Vendor ID and Password');", true);
           }
           else
           {
            var da = new SqlDataAdapter("select * from User_Info where Vendor_ID='Admin' AND User_Password='123456'", SqlCon);
              var dt = new DataTable();
              da.Fill(dt);
              if (dt.Rows.Count > 0)
              {
                Response.Redirect("~/AdminCompanyInfo.aspx");
              }
              var da2 = new SqlDataAdapter("select * from Company_Info where Vendor_ID='" + txtHomeUsername.Text.Trim() + "' AND Approval_Status='NO' OR                              Approval_Status='PEN'", SqlCon);
              var dt2 = new DataTable();
              da2.Fill(dt2);
              if (dt2.Rows.Count > 0)
              {
               string url = "../ApprovalStatus2.aspx?Parameter=" + Server.UrlEncode(txtHomeUsername.Text);
               ClientScript.RegisterStartupScript(this.GetType(), "callfunction", "alert('Your Vendor ID is waiting for Approval');window.location.href = '" +                       url + "';", true);
              }
              var da3 = new SqlDataAdapter("select Vendor_ID from RegPage1 where Vendor_ID='" + txtHomeUsername.Text.Trim() + "'", SqlCon);
              var dt3 = new DataTable();
              da3.Fill(dt3);
              if (dt3.Rows.Count > 0)
              {
                  string url = "../UserLogin.aspx";
                  ClientScript.RegisterStartupScript(this.GetType(), "callfunction", "alert('Your Vendor ID already completed the registration');window.location.href = '" + url + "';", true);
              }
              else
              {
                Response.Redirect("~/RegPage1.aspx?Parameter=" + Server.UrlEncode(txtHomeUsername.Text));
              }
           }
        }
        finally
        {
            SqlCon.Close();
        }
    }

Answer 1

While the examples given are functional, SQL injection is a huge problem here. you should be using Parameterized Queries.

http://blogs.msdn.com/b/sqlphp/archive/2008/09/30/how-and-why-to-use-parameterized-queries.aspx

Answer 2

Try this.. When you build an architecture consider this accessing database is most expensive access in code. And prefer to use SqlCommand (parameterized values).

 var da1 = new SqlDataAdapter("select * from User_Info where Vendor_ID='" + txtHomeUsername.Text.Trim() + "' AND User_Password='" + txtHomePassword.Text.Trim() + "'", SqlCon);
           var dt1 = new DataTable();
           da1.Fill(dt1);
           if (dt1.Rows.Count == 0)
           {
            ScriptManager.RegisterStartupScript(this, this.GetType(), "Alert", "alert('Enter valid Vendor ID and Password');", true);
           }
           else
           {

             switch(dt.Rows[0]["Vendor_ID"].ToString())
              {
               case "Admin": Response.Redirect("~/AdminCompanyInfo.aspx"); break;
              //other oprtions goes here...
              }
              var da2 = new SqlDataAdapter("select * from Company_Info where Vendor_ID='" + txtHomeUsername.Text.Trim() + "' AND Approval_Status='NO' OR                              Approval_Status='PEN'", SqlCon);
              var dt2 = new DataTable();
              da2.Fill(dt2);
              if (dt2.Rows.Count > 0)
              {
               string url = "../ApprovalStatus2.aspx?Parameter=" + Server.UrlEncode(txtHomeUsername.Text);
               ClientScript.RegisterStartupScript(this.GetType(), "callfunction", "alert('Your Vendor ID is waiting for Approval');window.location.href = '" +                       url + "';", true);
              }
              var da3 = new SqlDataAdapter("select Vendor_ID from RegPage1 where Vendor_ID='" + txtHomeUsername.Text.Trim() + "'", SqlCon);
              var dt3 = new DataTable();
              da3.Fill(dt3);
              if (dt3.Rows.Count > 0)
              {
                  string url = "../UserLogin.aspx";
                  ClientScript.RegisterStartupScript(this.GetType(), "callfunction", "alert('Your Vendor ID already completed the registration');window.location.href = '" + url + "';", true);
              }
              else
              {
                Response.Redirect("~/RegPage1.aspx?Parameter=" + Server.UrlEncode(txtHomeUsername.Text));
              }
           }