An Approach To Better Registration And Login In ASP.NET

In this tutorial, we will see a better approach towards the registration and login process in an ASP.NET, using C#, where will see hash passwords and how we manage the password correctly in login form. Also, we will see how to authenticate the duplicate user during the registration process.

Prerequisites

• Datatable having columns as username, password and an E-mail.
• Store Procedure, where one for inserting and one for authentication.
• 3 Web Forms – Register.aspx, login.aspx, home.aspx

Initial Chamber

Step 1

Open Your Visual Studio 2015 and create an empty Website. Give a suitable name [RegForm_demo].

Step 2

In Solution Explorer, you get your empty Website, followed by adding three Web Forms and SQL Server database.

For Web Form

RegForm_demo (Your Empty Website) -> Right click -> Add New Item -> Web Form. Name it as Register.aspx. Now, go to the same process, add other Web form and name it --> login.aspx and home.aspx.

For SQL Server database

RegForm_demo (Your Empty Website) -> Right click -> Add New Item -> SQL Server database. Add the database inside the App_Data_folder.

Database Chamber

Step 3

In Server Explorer, click on your database [Database.mdf] - -> Tables - -> Add New Table - -> Make the table, as shown below.

Store Procedure

sp_insert 

CREATE PROCEDURE [dbo].[sp_insert]
(
    -- Add the parameters for the stored procedure here


    @Username varchar(50),
    @Password varchar(50),
    @Email varchar(50)

)
as
Begin

    Declare @Count int
    Declare @codereturn int

    Select @Count = COUNT(Username)
    from tbl_data where Username = @Username
    If @Count > 0
    Begin

        Set @codereturn = -1
    End
    Else
    Begin

        Set @codereturn  = 1
        Insert into tbl_data values(@Username,@Password,@Email)

    End
    Select @codereturn as ReturnValue

End

sp_select 

CREATE PROCEDURE sp_select

    @Username varchar(50),
    @Password varchar(50)

AS
BEGIN
    Declare @Count int

    Select @Count = COUNT(Username)
    from tbl_data where [Username] =@Username and [Password] =@Password

    If (@Count = 1)
    Begin
     Select 1 as codereturn
    End
    Else
    Begin
        Select -1 as codereturn
    End


END

Design code

Step 4

Now, make some design for your Application by going to Register.aspx and design it, as shown below.

Register.aspx

Login.aspx

Code Chamber

Step 5

We will make some code in Register.aspx.cs page, so that our Register form works.

Register.aspx.cs 

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
using System.Data;
using System.Data.Sql;
using System.Web.Security;

namespace WebApplication3
{
    public partial class Register : System.Web.UI.Page
    {

        protected void Button1_Click(object sender, EventArgs e)
        {
            SqlConnection con = new SqlConnection(@"Data Source=Nilesh;Initial Catalog=test_db;Integrated Security=True");
            SqlCommand cmd = new SqlCommand("sp_insert", con);
            cmd.CommandType = CommandType.StoredProcedure;

            string encryp = FormsAuthentication.HashPasswordForStoringInConfigFile(TextBox2.Text, "SHA1");

            cmd.Parameters.AddWithValue("@Username", TextBox1.Text);
            cmd.Parameters.AddWithValue("@Password", encryp);
            cmd.Parameters.AddWithValue("@Email", TextBox4.Text);

            con.Open();
            int codereturn = (int)cmd.ExecuteScalar();
            if (codereturn == -1)
            {

                lblmsg.Text = "Username already exist!";
                lblmsg.ForeColor = System.Drawing.Color.Red;
            }
            else
            {
                Response.Redirect("~/Login.aspx");
            }
        }
    }
}

Login.aspx.cs

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data;
using System.Data.SqlClient;
using System.Web.Security;


namespace WebApplication3
{
    public partial class Login : System.Web.UI.Page
    {

        protected void Button1_Click(object sender, EventArgs e)
        {
            if (authenticate(TextBox1.Text, TextBox2.Text))
            {
                Response.Redirect("~/Home.aspx");
            }
            else
            {
                Label1.Text = "Invalid Username and Password";
                Label1.ForeColor = System.Drawing.Color.Red;
            }
        }
        private bool authenticate(string Username, string Passsword)
        {

            SqlConnection con = new SqlConnection(@"Data Source=Nilesh;Initial Catalog=test_db;Integrated Security=True");
            SqlCommand cmd = new SqlCommand("sp_select", con);
            cmd.CommandType = CommandType.StoredProcedure;

            string encryp = FormsAuthentication.HashPasswordForStoringInConfigFile(TextBox2.Text, "SHA1");

            cmd.Parameters.AddWithValue("@Username", TextBox1.Text);
            cmd.Parameters.AddWithValue("@Password",encryp);
            con.Open();
            int codereturn = (int)cmd.ExecuteScalar();
            return codereturn == 1;

        }

    }

}

Output

The user is registering with the username abc and password abc too,  and if successful, the login page will open, else the respective error message will be shown. Also, this data is saved in the database, as shown below. You can see the password is encrypted in hash format.

Let’s say, the user abc is registered and now another user comes. Register with the same username as abc and the authenticate procedure will call and an error will be shown, as given below.

Login page output

After successful registration, the user abc can access his account, using login access.

If login is successfuk, home page will be opened, else the respective error will be shown.

Hope, you liked it. Have a good day and thank you for reading.