User views and QueryString

[MiziaQ]

HI, I am trying to redirect users to the appropriate page based on the company role stored in the database. I have written the following code, but it doesn't seem to work. If the role is anything other than 'Admin', companyuser.aspx should load. Also, I am trying to append the user ID and username to the URL. At the moment it is hardcoded. Does anyone know how to obtain this from the db? Thanks in advance for your help!

protected void btnLogin_Authenticate(object sender, EventArgs e)
    {
        SqlDataSource sds = new SqlDataSource();
        sds.ConnectionString = ConfigurationManager.ConnectionStrings["MyConnection"].ToString();
 
        sds.SelectParameters.Add("Email", TypeCode.String, this.login_username.Text);
        sds.SelectParameters.Add("Password", TypeCode.String, this.login_password.Text);
 
        sds.SelectCommand = "SELECT * FROM Member WHERE [email] = @Email AND [Password] = @Password";
 
        DataView dv = (DataView)sds.Select(DataSourceSelectArguments.Empty);
 
        SqlConnection myConnection;
        SqlCommand myCommand;
        SqlDataReader myDataReader;
 
        myConnection = new SqlConnection(GetConnectionString());
        myConnection.Open();
 
        //prepare sql statements
        myCommand = new SqlCommand("SELECT * FROM Member", myConnection);
        myDataReader = myCommand.ExecuteReader();
 
        if (dv.Count == 0)
        {
            Response.Redirect("~/loginattempt.aspx");
        }
        else
        {
            while (myDataReader.Read())
            {
                string companyrole = myDataReader["CompanyRole"].ToString();
                if (companyrole.Equals("Admin"))
                {
 
                    int ID = 10;
                    string name = "Admin";
                    Response.Redirect("~/companyadmin.aspx?id=" + ID + "&name=" + name);
 
                }
                else
                {
                    int ID = 10;
                    string name = "Developer";
                    Response.Redirect("~/companyuser.aspx?id=" + ID + "&name=" + name);
                }
            }
        }
 
        //cleanup objects
        myDataReader.Close();
        myConnection.Close();
    }
 

[ThatThatGuy]

What's the structure of your Member table.
It must be having fields like ID and Password.
So you can use the existing DataReader instance to get the id and password.

 string companyrole = myDataReader["CompanyRole"].ToString();

The way you're checking the Company Role...

[MiziaQ]

Thanks, I got the QueryString working. The only problem now is that I get redirected to the companyadmin page even if the company role is not 'Admin'. Do you know how I can fix that? Thanks!