c# - ログインページの論理エラー

Question

ASP.NET 4.0、C#、および SQL Server 2008 を使用して Web サイトを開発しています。ログイン ページで、同じユーザーが登録時に何度もログインする必要があります。「Step-I」登録後、ユーザーは管理者の承認を待ちます。「管理者承認のみ」の後、ユーザーは「ステップ II」登録ページにリダイレクトできます。なので以下のようなコードを書きます。しかし、私のコードに基づいて、管理者の承認なしで、ユーザーが2回目にログインすると、ページは「ステップII」の登録にリダイレクトされます。それを防ぐ方法は？助けが必要。

   protected void BtnHomeUserSubmit_Click(object sender, EventArgs e)
   {
    SqlConnection SqlCon = new SqlConnection(GetConnectionString());
    try
    {          
     var da1 = new SqlDataAdapter
           ("select * from User_Info2 where Vendor_ID ='" +   txtHomeUsername.Text.Trim() + "'
   AND User_Password='" + txtHomePassword.Text.Trim() + "'", SqlCon);
   var dt1 = new DataTable();
   da1.Fill(dt1);
   if (dt1.Rows.Count == 0)
   {
           ScriptManager.RegisterStartupScript(this, this.GetType(), "Alert",
   "alert('Enter valid Vendor ID and Password');", true);
  }
  else
  {
  var da2 = new SqlDataAdapter
  ("select * from Company_Info where Vendor_ID='"+ txtHomeUsername.Text+"' 
      AND Approval_Status='NO' OR Approval_Status='PEN'", SqlCon);
  var dt2 = new DataTable();
  da2.Fill(dt2);
  if (dt2.Rows.Count > 0)
  {
   string url = "../ApprovalStatus2.aspx?Parameter=" + Server.UrlEncode(txtHomeUsername.Text);
   ClientScript.RegisterStartupScript(this.GetType(),
   "callfunction","alert('Vendor ID is waiting for Approval');
    window.location.href = '" + url + "';", true);
  }
  var da3 = new SqlDataAdapter
("select Vendor_ID from RegPage1 where Vendor_ID='" + txtHomeUsername.Text.Trim() + "'",SqlCon);
  var dt3 = new DataTable();
  da3.Fill(dt3);
  if (dt3.Rows.Count > 0)
  {
   string url = "../UserLogin.aspx";
   ClientScript.RegisterStartupScript(this.GetType(),"callfunction","alert
   ('Vendor ID already completed the registration');window.location.href ='" + url + "';", true);
  }
  else
  {
    Response.Redirect("~/RegPage1.aspx?Parameter=" + Server.UrlEncode(txtHomeUsername.Text));
  }
  }
  }
  finally
  {
  SqlCon.Close();
  }

Answer 1

次のようにコーディングを変更します。

var da2 = new SqlDataAdapter
  ("select * from Company_Info where Vendor_ID='"+ txtHomeUsername.Text+"' 
      AND (Approval_Status='NO' OR Approval_Status='PEN')", SqlCon);

それが役立つかどうか私に知らせてください。

Answer 2

コードの変更: 確認してお知らせください

protected void BtnHomeUserSubmit_Click(object sender, EventArgs e)
   {
    SqlConnection SqlCon = new SqlConnection(GetConnectionString());
    try
    {          
        var da1 = new SqlDataAdapter
           ("select * from User_Info2 where Vendor_ID ='" +   txtHomeUsername.Text.Trim() + "'
   AND User_Password='" + txtHomePassword.Text.Trim() + "'", SqlCon);
   var dt1 = new DataTable();
   da1.Fill(dt1);
   if (dt1.Rows.Count == 0)
   {
           ScriptManager.RegisterStartupScript(this, this.GetType(), "Alert",
        "alert('Enter valid Vendor ID and Password');", true);
   }
  else
  {
     var da2 = new SqlDataAdapter
      ("select * from Company_Info where Vendor_ID='"+ txtHomeUsername.Text+"' 
      AND (Approval_Status='NO' OR Approval_Status='PEN')", SqlCon);
      var dt2 = new DataTable();
      da2.Fill(dt2);
      if (dt2.Rows.Count > 0)
     {
           string url = "../ApprovalStatus2.aspx?Parameter=" +
                 Server.UrlEncode(txtHomeUsername.Text);
                 ClientScript.RegisterStartupScript(this.GetType(),
                "callfunction","alert('Vendor ID is waiting for Approval');
              window.location.href = '" + url + "';", true);
      }
      else
     {
             var da3 = new SqlDataAdapter
            ("select Vendor_ID from RegPage1 where Vendor_ID='" + 
              txtHomeUsername.Text.Trim() + "'",SqlCon);
            var dt3 = new DataTable();
            da3.Fill(dt3);
            if (dt3.Rows.Count > 0)
            {
                 string url = "../UserLogin.aspx";
                 ClientScript.RegisterStartupScript(this.GetType(),"callfunction",
                 "alert('Vendor ID already completed the 
                  registration');window.location.href ='" + url + "';", true);
             }
             else
             {
                  Response.Redirect("~/RegPage1.aspx?Parameter=" + 
                  Server.UrlEncode(txtHomeUsername.Text));
             }
       }
  }
  }
  finally
  {
  SqlCon.Close();
  }