How to reset password by using a secret code?

Question

1.00/5 (1 vote)

See more:

I want to do reset password by inserting the secret code to authorize the specific user. But, the coding that ive been applying didnt change or update the new password for the user. It identifies if the user is inserting right or wrong of their secret code but didnt update for the new password. Please help me to find the correct way to reset the user password.

What I have tried:

Private Sub btnSubmit_Click(sender As Object, e As EventArgs) Handles btnSubmit.Click 'FUNCTION IS EXECUTED WHEN BUTTON SUBMIT IS CLICKED

      cs.Open()
      Dim sql As String = "SELECT * FROM userlogistic WHERE user_id = '" & Request.Form("user") & "' AND user_securitycode = '" & Request.Form("user_securitycode") & "'"
      cmd.CommandText = sql
      cmd.Connection = cs
      reader = cmd.ExecuteReader

      If reader.HasRows Then 'CHECK IF USER ID AND PASSWORD EXIST IN DATABASE
          While reader.Read
              Session("user_no") = reader.Item("user_no")
              Session("user_id") = reader.Item("user_id")
              Session("user_name") = reader.Item("user_name")
              Session("user_password") = reader.Item("user_password")
              Session("user_rank") = reader.Item("user_rank")
              Session("user_section") = reader.Item("user_section")
              Session("user_securitycode") = reader.Item("user_securitycode")

          End While

      End If

      cs.Close()

      If Request.Form("user_securitycode") = Session("user_securitycode") Then
          If Request.Form("pass1") = Request.Form("pass2") Then 'CHECK IF FIRST PASSWORD IS = SECOND PASSWORD
              cs.Open()
              cmd.CommandText = "UPDATE userlogistic SET user_password = '" & Request.Form("pass1") & _
                  "' WHERE user_no = '" & Request.Form("userid") & "'" 'UPDATE TBL_USER WHERE USER_NO IS = TO SELECTED USERID
              cmd.Connection = cs
              cmd.ExecuteNonQuery()
              cs.Close()

              Dim message As String = "Successfully Updated User Password" 'NOTIFY USER THAT RECORD HAS BEEN SUCESFULLY UPDATED
              Dim sb As New System.Text.StringBuilder()
              sb.Append("<script type = 'text/javascript'>")
              sb.Append("window.onload=function(){")
              sb.Append("alert('")
              sb.Append(message)
              sb.Append("')};")
              sb.Append("</script>")
              ClientScript.RegisterClientScriptBlock(Me.GetType(), "alert", sb.ToString())

          Else

              Dim message2 As String = "Password Is Not The Same" 'NOTIFY USER THAT PASSWORD ONE AND TWO ARE NOT THE SAME
              Dim sb2 As New System.Text.StringBuilder()
              sb2.Append("<script type = 'text/javascript'>")
              sb2.Append("window.onload=function(){")
              sb2.Append("alert('")
              sb2.Append(message2)
              sb2.Append("')};")
              sb2.Append("</script>")
              ClientScript.RegisterClientScriptBlock(Me.GetType(), "alert", sb2.ToString())

          End If



      Else

          Dim message As String = "Security Password is incorrect" 'NOTIFY USER THAT RECORD HAS BEEN SUCESFULLY UPDATED
          Dim sb As New System.Text.StringBuilder()
          sb.Append("<script type = 'text/javascript'>")
          sb.Append("window.onload=function(){")
          sb.Append("alert('")
          sb.Append(message)
          sb.Append("')};")
          sb.Append("</script>")
          ClientScript.RegisterClientScriptBlock(Me.GetType(), "alert", sb.ToString())

      End If

      reader.Close()
      cs.Close()
  End Sub

Posted 3-Dec-20 20:41pm

syuhaiba hamizi

Updated 3-Dec-20 21:47pm

Add a Solution

1 solution

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

OriginalGriff · Answer 1 · 2020-12-03T21:47:00

Firstly, don't do it like that! Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Always use Parameterized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:

SQL

SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'

The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:

SQL

SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'

Which SQL sees as three separate commands:

SQL

SELECT * FROM MyTable WHERE StreetAddress = 'x';

A perfectly valid SELECT

SQL

DROP TABLE MyTable;

A perfectly valid "delete the table" command

SQL

--'

And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?
And doing that when the user isn't logged in? That's just really asking for trouble!

Secondly, never store passwords in clear text - it is a major security risk. There is some information on how to do it here: Password Storage: How to do it.[^] - the code is C#, but it's pretty obvious.

And remember: this is web based so if you have any European Union users then GDPR applies and that means you need to handle passwords as sensitive data and store them in a safe and secure manner. Text is neither of those and the fines can be .... um ... outstanding. In December 2018 a German company received a relatively low fine of €20,000 for just that.

Thirdly, Compiling does not mean your code is right! :laugh:
Think of the development process as writing an email: compiling successfully means that you wrote the email in the right language - English, rather than German for example - not that the email contained the message you wanted to send.

So now you enter the second stage of development (in reality it's the fourth or fifth, but you'll come to the earlier stages later): Testing and Debugging.

Start by looking at what it does do, and how that differs from what you wanted. This is important, because it give you information as to why it's doing it. For example, if a program is intended to let the user enter a number and it doubles it and prints the answer, then if the input / output was like this:

Input   Expected output    Actual output
  1            2                 1
  2            4                 4
  3            6                 9
  4            8                16

Then it's fairly obvious that the problem is with the bit which doubles it - it's not adding itself to itself, or multiplying it by 2, it's multiplying it by itself and returning the square of the input.
So with that, you can look at the code and it's obvious that it's somewhere here:

VB

Private Function Double(ByVal value As Integer) As Integer
    Return value * value
End Function

Once you have an idea what might be going wrong, start using the debugger to find out why. Put a breakpoint on the first line of the method, and run your app. When it reaches the breakpoint, the debugger will stop, and hand control over to you. You can now run your code line-by-line (called "single stepping") and look at (or even change) variable contents as necessary (heck, you can even change the code and try again if you need to).
Think about what each line in the code should do before you execute it, and compare that to what it actually did when you use the "Step over" button to execute each line in turn. Did it do what you expect? If so, move on to the next line.
If not, why not? How does it differ?
Hopefully, that should help you locate which part of that code has a problem, and what the problem is.
This is a skill, and it's one which is well worth developing as it helps you in the real world as well as in development. And like all skills, it only improves by use!