Quantcast
Channel: Security
Viewing all articles
Browse latest Browse all 4737

Pass email address after login and insert into database

$
0
0

The user uses email adddress and password to login. I put the email address in a session using:

//process login
        string query = "Select Count(*) From Client Where Email = ? And [Password] = ?";
        int result = 0;

        using (OleDbCommand cmd = new OleDbCommand(query, conn))
        {
            cmd.Parameters.AddWithValue("", TxtEmailAddress.Text);
            cmd.Parameters.AddWithValue("", txtPswd.Text);

            Session["Email"] = TxtEmailAddress.Text;
            result = (int)cmd.ExecuteScalar();
        }

        if (result > 0)
        {
            Response.Redirect("ClientSubmission.aspx");
        }
        else
        {
            BadCredentials.Visible = true;
        }

Then on the next page, the user submits some stuff and the submission along with the email address gets inputted into the DB using:

String Email = (string)(Session["Email"]);
        insertQuery = "INSERT INTO ClientSubmission (FileName, Email) ";
        insertQuery += "VALUES ('" + FileName.InnerHtml + "','" + Email + ")";
        OleDbCommand command = new OleDbCommand(insertQuery, conn); // create a command object for this sql
        command.ExecuteNonQuery(); // execute the sql statement
        command = new OleDbCommand("SELECT @@IDENTITY", conn);  // execute this sql statement to get the primary key of the added record
        int SubmissionID = (int)command.ExecuteScalar();              // in this case it is the Submission ID

However, I get the error:

Syntax error in string in query expression ''craig@gmail.com)'.






Viewing all articles
Browse latest Browse all 4737

Trending Articles



<script src="https://jsc.adskeeper.com/r/s/rssing.com.1596347.js" async> </script>