How to get value of DataTable Row in C# asp.net

Question

i am learning asp.net with c# by myself, and i have a problem with DataRows, in db i have users table and there is isadmin column which value is int, i want to redirect users to different page and admins to admin page, but the problem is all users redirects to admin page.

Here is my code;

 protected void btnLogin_Click(object sender, EventArgs e)
    {
        SqlConnection conn = new SqlConnection(conString);
        conn.Open();
            SqlCommand cmd = new SqlCommand("SELECT username, pass FROM users 
                                where username = '"+txtUser.Text+"'
                                and pass='"+txtPass.Text+"'"
                                , conn);
            SqlDataAdapter da = new SqlDataAdapter(cmd);
        DataTable dt = new DataTable();
        da.Fill(dt);

        SqlCommand cmd1 = new SqlCommand("Select username, isadmin From users", conn);
        SqlDataAdapter da1 = new SqlDataAdapter(cmd1);
        DataTable dt1 = new DataTable();
        da1.Fill(dt1);

        conn.Close();
        if (dt.Rows.Count > 0)
        {
            Session["id"] = txtUser.Text;
            if (dt1.Rows[0]["isadmin"].ToString() == "1")
            {
                Response.Redirect("~/admin.aspx");
            }
            else
            {
                Response.Redirect("~/default.aspx");
            }


            //Response.Redirect("~/default.aspx");

            Session.RemoveAll();
        }
        else
        {
            lblMsg.ForeColor = System.Drawing.Color.Red;
            //lblMsg.Text= msg ;

                /*Response.Write("<script>
                alert('Please enter valid Username and Password')
                </script>"); */
        }

Can you please tell me what is wrong?

Answer 1

Your second query lacks the filter on a user name:

Select username, isadmin From users

So whatever it fetches - if the first row contains 1 as IsAdmin, all users will be redirected to the admin page.

Answer 2

There are several things wrong with your code:

1. All users are redirected to the admin page since you are checking the isAdmin in the wrong query. Your second query has no where clause which means it will return all the users in the table. The first user it returns has the isAdmin value of 1.
   You don't actually need two queries, just one.

2. You must use parameterized queries, otherwise you are leaving an open door to SQL injection attacks.

3. wrap all IDisposable instances in a using statement.

Your code should look more like this:

protected void btnLogin_Click(object sender, EventArgs e)
{
    DataTable dt = new DataTable();
    using(SqlConnection conn = new SqlConnection(conString))
    {
        using(SqlCommand cmd = new SqlCommand("SELECT username, pass, isadmin FROM users where username = @UserName and pass=@Pass", conn))
        {
            cmd.Parameters.Add("@UserName", SqlDbType.VarChar).Value = txtUser.Text;
            cmd.Parameters.Add("@Pass", SqlDbType.VarChar).Value = txtPass.Text;
            SqlDataAdapter da = new SqlDataAdapter(cmd);
            da.Fill(dt);
        }   

    }
    if (dt.Rows.Count > 0)
    {
        Session["id"] = txtUser.Text;
        if (dt1.Rows[0]["isadmin"].ToString() == "1")
        {
            Response.Redirect("~/admin.aspx");
        }
        else
        {
            Response.Redirect("~/default.aspx");
        }


        //Response.Redirect("~/default.aspx");

        Session.RemoveAll();
    }
    else
    {
        lblMsg.ForeColor = System.Drawing.Color.Red;
        //lblMsg.Text= msg ;

        //Response.Write("<script>alert('Please enter valid Username and Password')</script>");
    }

}

Answer 3

Use the first query with dt as it's based on a single user. The problem is dt1 gets all users and the first record in that datatable is an admin

if (dt.Rows[0]["isadmin"].ToString() == "1") {

Remove the second query with dt1 and make sure you add isadmin to the first SQL query.

SqlCommand cmd = new SqlCommand("SELECT username, pass, isadmin FROM users where username = @UserName and pass= @Pass", conn); 

See how I use parameterized username and password, that is to protect against SQL injection, definitely read up on that!!!

Answer 4

In your first query you need to get isadmin also and on the base of that result you can check either it is 1 or not and can redirect to what ever page you like. So it will be as follow:

protected void btnLogin_Click(object sender, EventArgs e)
{
    SqlConnection conn = new SqlConnection(conString);
    conn.Open();
    SqlCommand cmd = new SqlCommand("SELECT username, pass, isadmin FROM users where username = '"+txtUser.Text+"' and pass='"+txtPass.Text+"'", conn);
    SqlDataAdapter da = new SqlDataAdapter(cmd);
    DataTable dt = new DataTable();
    da.Fill(dt);
    conn.Close();
    if (dt.Rows.Count > 0)
    {
        Session["id"] = txtUser.Text;
        if (dt.Rows[0]["isadmin"].ToString() == "1")
        {
            Response.Redirect("~/admin.aspx");
        }
        else
        {
            Response.Redirect("~/default.aspx");
        }
        //Response.Redirect("~/default.aspx");
        Session.RemoveAll();
    }
    else
    {
        lblMsg.ForeColor = System.Drawing.Color.Red;
        //lblMsg.Text= msg ;
        //Response.Write("<script>alert('Please enter valid Username and Password')</script>");
    }
}

Answer 5

Please Try this

protected void btnLogin_Click(object sender, EventArgs e)
{
    SqlConnection conn = new SqlConnection(conString);
    conn.Open();
    SqlCommand cmd =
        new SqlCommand(
            "SELECT username, pass, isadmin FROM users where username = '" + txtUser.Text + "' and pass='" + txtPass.Text +
            "'", conn);
    SqlDataAdapter da = new SqlDataAdapter(cmd);
    DataTable dt = new DataTable();
    da.Fill(dt);

    conn.Close();
    if (dt.Rows.Count > 0)
    {
        Session["id"] = txtUser.Text;
        if (dt.Rows[0]["isadmin"].ToString() == "1")
        {
            Response.Redirect("~/admin.aspx");
        }
        else
        {
            Response.Redirect("~/default.aspx");
        }


        //Response.Redirect("~/default.aspx");

        Session.RemoveAll();
    }
    else
    {
        lblMsg.ForeColor = System.Drawing.Color.Red;
        //lblMsg.Text= msg ;

        //Response.Write("<script>alert('Please enter valid Username and Password')</script>");
    }
}