reset password with link sent to email id

Question

i have a page where if the user has forgotten their password they type in their email addr and if they are on the database they will be sent a link to the reset password page so they can enter their new password. firstly i generate a new guid and update my user table with it when user clicks on forgot password ,my problem is that the table is not being updated with new guid (i ran the query on sql and it worked) , the user receives the link via email to reset password but the password does not get reset. not sure what im missing

 

here is the code for both pages:

Forgot page 

protected void LinkButton1_Click1(object sender, EventArgs e)
    {
        Response.Redirect("~/index.aspx");
    }


    public void forgotpassword()
    {
        SqlConnection con = new SqlConnection(strConnString);
        SqlCommand cmd = new SqlCommand("select * from [dbo].[Register] where pb_Email= @email", con);
        cmd.Parameters.AddWithValue("@email", txtEmailP.Text);

        con.Open();
        SqlDataReader dr = cmd.ExecuteReader();

        if (dr.HasRows)
            {
                dr.Read();


                string uniqueCode = Convert.ToString(System.Guid.NewGuid());
                SqlCommand com = new SqlCommand("update [Register] set [UniqueCode] = @uniqueCode where pb_Email= @email", con);
                com.Parameters.AddWithValue("@uniqueCode",uniqueCode);
                com.Parameters.AddWithValue("@email",txtEmailP.Text.Trim());

                 try
            {
                string emailFrom = "[email protected]";



                StringBuilder strBody = new StringBuilder();
                //Passing emailid,username and generated unique code via querystring. For testing pass your localhost number and while making online pass your domain name instead of localhost path.
                strBody.Append("<a href=http://localhost:7902/ResetPassword.aspx?emailId=" + txtEmailP.Text + "&uCode=" + uniqueCode + ">Click here to change your password</a>");
                // sbody.Append("&uCode=" + uniqueCode + txtUserName.Text + ">Click here to change your password</a>");




                string body = "<div style='border: medium solid grey; width: 500px; height: 266px;font-family: arial,sans-serif; font-size: 17px;'>";
                body += "<h3 margin-top:0px;'>Password Recovery</h3>";
                body += "<br />";
                body += strBody;
                body += "<br />";
                body += "<br />";
                body += "Kinds Regards";
                body += "<br />";
                body += "</div>";

                System.Net.Mail.MailMessage message = new System.Net.Mail.MailMessage();
                //message.To.Add(emailTo);
                //message.Subject = subject;
                message.From = new System.Net.Mail.MailAddress(emailFrom);
                message.IsBodyHtml = true;
                message.Body = body;
                message.Priority = System.Net.Mail.MailPriority.High;
                message.Subject = "Password Reset";

                message.From = new System.Net.Mail.MailAddress(emailFrom);


                SmtpClient SmtpMail = new SmtpClient();
                SmtpMail.EnableSsl = true;
                SmtpMail.Port = 25;
                SmtpMail.Host = "myhost";

                System.Net.ServicePointManager.ServerCertificateValidationCallback = delegate(object s,
                          System.Security.Cryptography.X509Certificates.X509Certificate certificate,
                          System.Security.Cryptography.X509Certificates.X509Chain chain,
                          System.Net.Security.SslPolicyErrors sslPolicyErrors)
                {
                    return true;
                };

                // compare session username to username in database
                SqlCommand command = new SqlCommand(@"SELECT Email FROM [Register] WHERE @email = [Email]");
                command.Parameters.AddWithValue("@email", txtEmailP.Text);

                using (SqlConnection connection =
                           new SqlConnection(strConnString))
                {

                    connection.Open();

                    command.Connection = connection;

                    SqlDataReader reader = command.ExecuteReader();

                    // Call Read before accessing data.
                    while (reader.Read())
                    {

                        var to = new MailAddress(reader["Email"].ToString());
                        message.To.Add(to);

                    }

                    // Passing values to smtp object
                    SmtpMail.Send(message);




                    ScriptManager.RegisterStartupScript(this, this.GetType(), "redirect", "alert('request submitted.an email will be sent to you'); window.location='" + Request.ApplicationPath + "index.aspx';", true);
              ;

                    // Call Close when done reading.
                    reader.Close();
                }



            }



            catch (Exception ex)
            {
                throw ex;
            }


        }

            }


    protected void Button1_Click(object sender, EventArgs e)
    {

        //this.forgot();
        this.forgotpassword();
    }
}

 Reset page

protected void Page_Load(object sender, EventArgs e)
   {
       if (!Page.IsPostBack)
       {
           SqlDataReader dr;
           try
           {
               SqlConnection con = new SqlConnection(strConnString);
               SqlCommand cmd = new SqlCommand("select Email,UniqueCode from [Register] where UniqueCode=@uniqueCode and Email=@email", con);
               cmd.Parameters.AddWithValue("@uniqueCode", Convert.ToString(Request.QueryString["uCode"]));
               cmd.Parameters.AddWithValue("@email", Convert.ToString(Request.QueryString["emailId"]));

               con.Open();
               dr = cmd.ExecuteReader();
               dr.Close();
               con.Close();
           }

           catch (Exception)
           {
               //ClientScript.RegisterStartupScript(GetType(), "alert", ex.ToString(), true);

           }


       }
   }

   private string Encrypt(string clearText)
   {
       string EncryptionKey = "ABCDEFGHIJKLMNOPQRSTUVWXYZ123456789";
       byte[] clearBytes = Encoding.Unicode.GetBytes(clearText);
       using (Aes encryptor = Aes.Create())
       {
           Rfc2898DeriveBytes pdb = new Rfc2898DeriveBytes(EncryptionKey, new byte[] { 0x49, 0x76, 0x61, 0x6e, 0x20, 0x4d, 0x65, 0x64, 0x76, 0x65, 0x64, 0x65, 0x76 });
           encryptor.Key = pdb.GetBytes(32);
           encryptor.IV = pdb.GetBytes(16);
           using (MemoryStream ms = new MemoryStream())
           {
               using (CryptoStream cs = new CryptoStream(ms, encryptor.CreateEncryptor(), CryptoStreamMode.Write))
               {
                   cs.Write(clearBytes, 0, clearBytes.Length);
                   cs.Close();
               }
               clearText = Convert.ToBase64String(ms.ToArray());
           }
       }
       return clearText;
   }


   protected void Button1_Click(object sender, EventArgs e)
   {
       try
       {
           SqlConnection con = new SqlConnection(strConnString);
           // Here we will update the new password and also set the unique code to null so that it can be used only for once.
           SqlCommand cmd = new SqlCommand("update [Register] set UniqueCode='',Password=@pwd where uniqueCode=@uniqueCode and Email=@emailid", con);
           cmd.Parameters.AddWithValue("@uniqueCode", Convert.ToString(Request.QueryString["uCode"]));
           cmd.Parameters.AddWithValue("@emailid", Convert.ToString(Request.QueryString["emailId"]));

           cmd.Parameters.AddWithValue("@pwd", Encrypt(txtNewPassword.Text.Trim()));
           if (con.State == ConnectionState.Closed)
           {
               con.Open();
           }
           cmd.ExecuteNonQuery();

           txtNewPassword.Text = string.Empty;
           ClientScript.RegisterStartupScript(GetType(), "alert", "alert('password updated');", true);
           con.Close();
           cmd.Dispose();
           //Response.Redirect("~/index.aspx");
       }
       catch (Exception)
       {
           //ClientScript.RegisterStartupScript(GetType(), "alert", ex.Message.ToString(), true);
       }

   }