1

I have seen a lot redirect questions here but my issue is slightly different.

Please see code below.

    Sub CmdLogin_Click(ByVal Sender As Object, ByVal E As EventArgs) Handles CmdLogin.Click

    Dim MySQL As String
    Dim MyCount As SqlCommand
    Dim IntUserCount As Integer

    Dim redirect As String = Request.QueryString("redirect")
    Using myConnectionString As SqlConnection = New SqlConnection(ConfigurationManager.ConnectionStrings("constr").ConnectionString)

        'Dim myConnection As New SqlConnection(myConnectionString)
        Try
            myConnectionString.Open()
            MySQL = "SELECT COUNT(*) FROM EmployeeData WHERE empnum = '" & Replace(txtEmail.Text, "'", "''") & "' and empnum = '" & txtPassword.Text & "' "

            MyCount = New SqlCommand(MySQL, myConnectionString)
            IntUserCount = MyCount.ExecuteScalar()
            Dim cmd As New SqlCommand("Select Department, unit, oldtitle, EmpName,newtitle,empnum, DBM,NewClassification,grade,Email,zip FROM EmployeeData Where empnum = @empnum and zip=@Password ", myConnectionString)
            cmd.Parameters.AddWithValue("@Password", txtPassword.Text)
            cmd.Parameters.AddWithValue("@empnum", txtEmail.Text)
            Dim dr As SqlDataReader = cmd.ExecuteReader()
            If dr.Read() Then
                Session("fullname") = dr("empName")
                Session("dept") = dr("Department")
                Session("password") = dr("zip")
                Session("empNum") = dr("empnum")

                ' Re-direct to original page
                If redirect IsNot Nothing AndAlso redirect.Length > 0 Then
                    Response.Redirect(redirect)
                Else
                    Response.Redirect("~/benefitspage.aspx")
                End If
            Else
                lblMsg.ForeColor = System.Drawing.Color.Red
                lblMsg.Text = "Invalid username password combination"
            End If

        Catch ex As SqlException
            Response.Write("<SCRIPT LANGUAGE='JavaScript'>alert('" + ex.Message + "')</SCRIPT>")
        Finally
            If myConnectionString IsNot Nothing AndAlso myConnectionString.State = ConnectionState.Open Then
                myConnectionString.Close()
            End If
        End Try
    End Using
End Sub

A user enters username/password.

If successfully authenticated, the user is redirected to a page which presents user with his/her benefit entitlements.

The user then clicks a link at the bottom of that page to continue:

<div align="center"> <a href="ReviewProcedures.aspx?user=session("fullname")Continue >> </a></div>

Once clicked, the user is taken to another page that presents instructions on how to make apply for changes to his/her benefits package.

After reading the instructions, the user clicks another link to go to the page to apply for changes:

Continue to Appeals page >>

So far, so good.

Here is the issue:

When the user logs in again, we would like to check the database to see if the user has applied for changes before (based on his ID).

If the user has applied before, then redirect the user to the edits.aspx page to make changes to his/her records.

In other words, if this is the first time the user is applying, once the user is successfully authenticated, the user sees his/her benefits page, then his/her instructions page and finally to apply.aspx page.

If the user has already applied, once authenticated, redirect user to benefits page, instructions page and finally to this time, to edits.aspx page.

The redirect keeps taking the user to edits.aspx page no matter what I try.

Any ideas?

Sorry for long explanation.

Chidi Okeh
  • 1,537
  • 8
  • 28
  • 50
  • You would need to keep track of if the user has already visited that page, maybe a `UserActivity` table which stores their ID. If that ID exists for that user, simply redirect them to the appropriate page. – Darren Sep 09 '15 at 20:06
  • That code is wide open for SQL injection attacks (http://stackoverflow.com/a/15596300/16391). You should strongly consider using parameterized SQL. – StingyJack Sep 09 '15 at 20:07
  • Right, you are correct. That first sql SELECT is. That's not the final piece. – Chidi Okeh Sep 09 '15 at 20:32
  • @DarrenDavies, I have done this several times before - successfully. I guess what is throwing me off this time is the two additional pages user has to navigate before getting to the edit pages. – Chidi Okeh Sep 09 '15 at 20:34

0 Answers0