Hi,

Can you please help me understand if I am doing something wrong? I am doing something that seems very wasteful, and I imagine that there is a much better way to do this.

I am trying to lookup a user in a table and log them in, if the credentials are right. There should only be one account that matches the email address. The code I have written gets a record set and then foreach's through it. It feels very inefficient.

This is running on ASP.NET 2.0, SqlServer2000 and LLBLGen Pro 2.0

    protected void LogInButton_Click(object sender, EventArgs e)
    {
        // Load user data based on Email address
        EntityCollection users = new EntityCollection(new UserEntityFactory());

        IRelationPredicateBucket filterBucket = new RelationPredicateBucket();
        filterBucket.PredicateExpression.Add(UserFields.Email == EmailTextbox.Text.Trim());
        filterBucket.PredicateExpression.AddWithAnd(UserFields.Password == PasswordTextbox.Text.Trim());

        DataAccessAdapter adapter = new DataAccessAdapter();
        adapter.FetchEntityCollection(users, filterBucket);

        // Does user exist?
        if (users.Count > 0)
        {
            // Populate variables
            foreach (UserEntity user in users)
            {
                Session["LoggedIn"] = "YES";
                Session["Name"] = user.Name;
                Session["Email"] = user.Email;
                Session["Password"] = user.Password;

                Server.Transfer("default.aspx");
            }
        }
        else
        {
            ForgotPasswordEmailTextbox.Text = EmailTextbox.Text;

            SystemFeedbackLabel.Text = "Sorry, I couldn't sign you in.<BR>Is everything typed in correctly?<br>If you forgot your password, please click<BR>the Remind Me button, or try again.";
        }
    }

Can you please share with me how you would make this better?

Thank you, Mike

if there is a unique constraint on the email address or the email address is the PK then you wouldn't need to loop. this would work instead.

 if (users.Count == 1)
{
   // Populate variables
   Session["LoggedIn"] = "YES";
   Session["Name"] = users[0].Name;
   Session["Email"] = users[0].Email;
   Session["Password"] = users[0].Password;

   Server.Transfer("default.aspx");
}
else
{
   ...      
}

if there is a unique constraint on both the emailaddress and password use the adapter.FetchEntityByUC and then pass the UserEntity.EmaillAddressPasswordUC to the function. This would return exactly 1 record (if it exists).

2 thoughts about the routine. why not just save the UserEntity into session like

 if (users.Count == 1)
{
   // Populate variables
   Session["User"] = user[0];

   Server.Transfer("default.aspx");
}
else
{
   ...      
}

second. You should consider using a 1 way hash to encrypt passwords. Use the VS help and look up MD5 or SHA1 on how to implement. Maybe your sytem requires the admin to know users passwords and this point is mute. I thought is was worth a mention though.