如何检查用户是否是“管理员”

Question

我正在开发使用ASP.NET 4.0和SQL Server 2008的网站。在Login Page中，我必须检查用户供应商ID并根据供应商ID重定向页面到不同的页面。一切正常，但我不知道如何检查管理员何时输入VendorID和密码，以便管理页面重定向。他的供应商ID和密码也与其他用户存储在同一个表“User_Info”中。请参阅下面的代码，它总是重定向到管理页面，因为我直接在代码中提供了他的vendorID和密码。请给出您的建议来解决此问题。

protected void BtnHomeUserSubmit_Click(object sender, EventArgs e) 
    { 
     SqlConnection SqlCon = new SqlConnection(GetConnectionString()); 
     try 
     {   
     var da1 = new SqlDataAdapter("select * from User_Info where Vendor_ID='" + txtHomeUsername.Text.Trim() + "' AND User_Password='" + txtHomePassword.Text.Trim() + "'", SqlCon); 
      var dt1 = new DataTable(); 
      da1.Fill(dt1); 
      if (dt1.Rows.Count == 0) 
      { 
      ScriptManager.RegisterStartupScript(this, this.GetType(), "Alert", "alert('Enter valid Vendor ID and Password');", true); 
      } 
      else 
      { 
      var da = new SqlDataAdapter("select * from User_Info where Vendor_ID='Admin' AND User_Password='123456'", SqlCon); 
       var dt = new DataTable(); 
       da.Fill(dt); 
       if (dt.Rows.Count > 0) 
       { 
       Response.Redirect("~/AdminCompanyInfo.aspx"); 
       } 
       var da2 = new SqlDataAdapter("select * from Company_Info where Vendor_ID='" + txtHomeUsername.Text.Trim() + "' AND Approval_Status='NO' OR        Approval_Status='PEN'", SqlCon); 
       var dt2 = new DataTable(); 
       da2.Fill(dt2); 
       if (dt2.Rows.Count > 0) 
       { 
       string url = "../ApprovalStatus2.aspx?Parameter=" + Server.UrlEncode(txtHomeUsername.Text); 
       ClientScript.RegisterStartupScript(this.GetType(), "callfunction", "alert('Your Vendor ID is waiting for Approval');window.location.href = '" +      url + "';", true); 
       } 
       var da3 = new SqlDataAdapter("select Vendor_ID from RegPage1 where Vendor_ID='" + txtHomeUsername.Text.Trim() + "'", SqlCon); 
       var dt3 = new DataTable(); 
       da3.Fill(dt3); 
       if (dt3.Rows.Count > 0) 
       { 
        string url = "../UserLogin.aspx"; 
        ClientScript.RegisterStartupScript(this.GetType(), "callfunction", "alert('Your Vendor ID already completed the registration');window.location.href = '" + url + "';", true); 
       } 
       else 
       { 
       Response.Redirect("~/RegPage1.aspx?Parameter=" + Server.UrlEncode(txtHomeUsername.Text)); 
       } 
      } 
     } 
     finally 
     { 
      SqlCon.Close(); 
     } 
    } 

Answer 1

试试这个.. 当你建立一个架构考虑这个访问数据库是代码最昂贵的访问。而且更喜欢使用SqlCommand（参数化值）。

var da1 = new SqlDataAdapter("select * from User_Info where Vendor_ID='" + txtHomeUsername.Text.Trim() + "' AND User_Password='" + txtHomePassword.Text.Trim() + "'", SqlCon); 
      var dt1 = new DataTable(); 
      da1.Fill(dt1); 
      if (dt1.Rows.Count == 0) 
      { 
      ScriptManager.RegisterStartupScript(this, this.GetType(), "Alert", "alert('Enter valid Vendor ID and Password');", true); 
      } 
      else 
      { 

      switch(dt.Rows[0]["Vendor_ID"].ToString()) 
       { 
       case "Admin": Response.Redirect("~/AdminCompanyInfo.aspx"); break; 
       //other oprtions goes here... 
       } 
       var da2 = new SqlDataAdapter("select * from Company_Info where Vendor_ID='" + txtHomeUsername.Text.Trim() + "' AND Approval_Status='NO' OR        Approval_Status='PEN'", SqlCon); 
       var dt2 = new DataTable(); 
       da2.Fill(dt2); 
       if (dt2.Rows.Count > 0) 
       { 
       string url = "../ApprovalStatus2.aspx?Parameter=" + Server.UrlEncode(txtHomeUsername.Text); 
       ClientScript.RegisterStartupScript(this.GetType(), "callfunction", "alert('Your Vendor ID is waiting for Approval');window.location.href = '" +      url + "';", true); 
       } 
       var da3 = new SqlDataAdapter("select Vendor_ID from RegPage1 where Vendor_ID='" + txtHomeUsername.Text.Trim() + "'", SqlCon); 
       var dt3 = new DataTable(); 
       da3.Fill(dt3); 
       if (dt3.Rows.Count > 0) 
       { 
        string url = "../UserLogin.aspx"; 
        ClientScript.RegisterStartupScript(this.GetType(), "callfunction", "alert('Your Vendor ID already completed the registration');window.location.href = '" + url + "';", true); 
       } 
       else 
       { 
       Response.Redirect("~/RegPage1.aspx?Parameter=" + Server.UrlEncode(txtHomeUsername.Text)); 
       } 
      } 

Answer 2

尽管给出的例子是功能性的，但SQL注入在这里是个大问题。你应该使用参数化查询。

http://blogs.msdn.com/b/sqlphp/archive/2008/09/30/how-and-why-to-use-parameterized-queries.aspx