Hello, everybody.  I created a login page where a user enters the e-mail address and password.  I created a stored procedure on a SQL 2005 named VerifyLogin that looks like this:

( @email varchar(50),

I am having problems coding the Login button on the Login page to check the user's input.  The code for the button click event looks like this:

Try 

ALTER PROCEDURE [dbo].[VerifyLogin]
( @email    varchar(50),
  @password varchar(20),
  @valid    BIT OUTPUT
) AS
SET @valid = 0
IF EXISTS(SELECT * FROM customers WHERE email = @email AND password = @password) SET @valid = 1

and
    protected void btnLogin_Click(object sender, EventArgs e)
    {
      try
      {
        string strConn = Convert.ToString(ConfigurationManager.ConnectionStrings["SQLConnectionString"]);
        SqlConnection conn = new SqlConnection(strConn);
        conn.Open();
        SqlCommand cmd = new SqlCommand("VerifyLogin", conn);
        cmd.CommandType =    CommandType.StoredProcedure;
        cmd.Parameters.AddWithValue("email", txtEmail.Text);
        cmd.Parameters.AddWithValue("password", txtPassword.Text);
        cmd.Parameters.AddWithValue("valid", false);
        cmd.Parameters["@valid"].Direction = ParameterDirection.Output;
        cmd.Connection.Open();
        cmd.ExecuteNonQuery();
        cmd.Connection.Close();
        if (cmd.Parameters["@valid"].Value == true)
        {
          lblLoginError.Visible =      true;
          lblLoginError.Text =     "Login Successful!";
          //Response.Redirect("~/default.aspx");
          //send to the default page to test
        }
        else
        {
          lblLoginError.Visible =    true;
          lblLoginError.Text =     "Login unsuccessful";
          //Response.Redirect("Login.aspx");
        }
      }
      catch (Exception ex)
      {
        Console.Write(ex.ToString());
      }
    }

In my opinion the result of this sort of single value query should always be returned by an output variable, never a recordset. 

Hi...thank you for your reply.  When I run it, I get a 'cmd.Parameters["@valid"]' threw an exception of type 'System.IndexOutOfRangeException'

Antonio

I am on mt VS2003 pc at the moment, however try

    protected void btnLogin_Click(object sender, EventArgs e)
    {
      try
      {
        string strConn = Convert.ToString(ConfigurationManager.ConnectionStrings["SQLConnectionString"]);
        SqlConnection conn = new SqlConnection(strConn);
        conn.Open();
        SqlCommand cmd = new SqlCommand("VerifyLogin", conn);
        cmd.CommandType =    CommandType.StoredProcedure;
        cmd.Parameters.AddWithValue("@email", txtEmail.Text);
        cmd.Parameters.AddWithValue("@password", txtPassword.Text);
        cmd.Parameters.AddWithValue("@valid", false);
        cmd.Parameters["@valid"].Direction = ParameterDirection.Output;
        cmd.Connection.Open();
        cmd.ExecuteNonQuery();
        cmd.Connection.Close();
        if (cmd.Parameters["@valid"].Value == true)
        {
          lblLoginError.Visible =      true;
          lblLoginError.Text =     "Login Successful!";
          //Response.Redirect("~/default.aspx");
          //send to the default page to test
        }
        else
        {
          lblLoginError.Visible =    true;
          lblLoginError.Text =     "Login unsuccessful";
          //Response.Redirect("Login.aspx");
        }
      }
      catch (Exception ex)
      {
        Console.Write(ex.ToString());
      }
    }

Hi...I did try that and it never hits the successful login, even with the correct e-mail and password.  I think the problem is in the IF statement.  You can't have the .Value == true as it can't explicitly convert an int to a bool value.

Antonio

It should be
        if ((bool)cmd.Parameters["@valid"].Value == true)

I normally use a NullToBoolean function at that point. 

Thank you!  That did it.

Antonio