<%@ Page Language="C#"%>
<%@ Import Namespace="System.Data" %>
<%@ Import Namespace="System.Data.SqlClient" %>
protected void Button1_Click(object sender, EventArgs e)
{
SqlConnection conn;
SqlCommand cmd;
string cmdString = "SELECT [Password] FROM [AccessTable] WHERE" +
" (([Username] = @Username) AND ([Password] = @Password))";
conn = new SqlConnection("Data Source=localhost;Initial " +
"Catalog=Northwind;Persist Security Info=True;User ID=sa");
cmd = new SqlCommand(cmdString, conn);
cmd.Parameters.Add("@Username", SqlDbType.VarChar, 50);
cmd.Parameters["@Username"].Value = TextBox1.Text;
cmd.Parameters.Add("@Password", SqlDbType.VarChar, 50);
cmd.Parameters["@Password"].Value = TextBox2.Text;
conn.Open();
SqlDataReader myReader;
myReader = cmd.ExecuteReader(CommandBehavior.CloseConnection);
if (myReader.Read()) {
FormsAuthentication.RedirectFromLoginPage(TextBox1.Text, false);
}
else {
Response.Write("Invalid credentials");
}
myReader.Close();
}