Login.aspx??? Error

[Sam]

I'm trying to create authentication for username and password but encounter
below error message:

Error Message
-----------------------
The ConnectionString property has not been initialized.
Description: An unhandled exception occurred during the execution of the
current web request. Please review the stack trace for more information
about the error and where it originated in the code.

Exception Details: System.InvalidOperationException: The ConnectionString
property has not been initialized.

Source Error:
Line 20:
Line 21: Try
Line 22: con.Open()
Line 23:
Line 24: Dim rd as SqlDataReader = cmd.ExecuteReader()

Source File: C:\JDE_Archival\authentication.aspx Line: 22

Stack Trace:

[InvalidOperationException: The ConnectionString property has not been
initialized.]
System.Data.SqlClient.SqlConnection.Open() +809
ASP.authentication_aspx.authenticate(Object Sender, EventArgs e) in
C:\JDE_Archival\authentication.aspx:22
System.Web.UI.WebControls.Button.OnClick(EventArgs e) +108
System.Web.UI.WebControls.Button.System.Web.UI.IPostBackEventHandler.RaisePostBackEvent(String
eventArgument) +57
System.Web.UI.Page.RaisePostBackEvent(IPostBackEventHandler
sourceControl, String eventArgument) +18
System.Web.UI.Page.RaisePostBackEvent(NameValueCollection postData) +33
System.Web.UI.Page.ProcessRequestMain() +1263

Version Information: Microsoft .NET Framework Version:1.0.3705.209; ASP.NET
Version:1.0.3705.0


Coding ASP.Net
-----------------------
Sub authenticate(Sender as Object, e As EventArgs)
Dim con As New
SqlConnection(ConfigurationSettings.AppSettings("constring"))

Dim cmd as New SqlCommand()
cmd.CommandText = "Select * from authentication where username ='"
& txtUsername.Text & "'"
cmd.Connection = con

Try
con.Open()

Dim rd as SqlDataReader = cmd.ExecuteReader()

While rd.read()
If rd("password").ToString = txtPassword.Text Then
FormsAuthentication.RedirectFromLoginPage(txtUsername.Text,
false)
Else
Response.Redirect("http://localhost/warning.aspx")
End If
End While

rd.Close()

Finally
con.Close()
End Try
End Sub

 

[Karl Seguin]

Your code is fine (although see the following note), so you might want to
check that ConfigurationSettings.AppSettings("constring") is actually
returning what you expect it to...my guess is it isn't.

Your code is open to a pretty _huge_ SQL Injection attack. This type of
code will be the death of your application:

 

[Karl Seguin]

oopppss...sent that a little too quickly.

Anyways, this code:
Select * from authentication where username ='" & txtUsername.Text & "'"

will be the death of you, consider replacing that with parameterized
properties:

cmd.CommandText = "Select * from authentication where username = @UserName"
cmd.Parameters.Add("@UserName", SqlDbType.VarChar, 50).Value =
txtUsername.Text

Karl