asp.net get current User Id

Question

In code Behind i have this :

 protected void ButtonSave_Click(object sender, EventArgs e)
        {
            Guid guid = (Guid)Membership.GetUser().ProviderUserKey;
            string name = TextBoxCategoryName.Text;
           // string user = Membership.GetUser().UserName;
            this.connection.Open();
            command = connection.CreateCommand();
            command.CommandText = "insert into ProfitCategories(name, IdUser) values ( '" + name + "', "+guid+" )";
            command.ExecuteNonQuery();

            connection.Close();
        }

but this give error: Incorrect syntax near 'a8'. how to get GUID from current user and insert into database

Parameterize your query to protect against SQL injection and I bet your problem will be solved. — MikeSmithDev
– MikeSmithDev, Commented Apr 1, 2013 at 22:30
Have a look here: msdn.microsoft.com/en-us/library/… Parametrizing your parameters will protect you against SQL injection and make your application (more) secure. — nimeshjm
– nimeshjm, Commented Apr 1, 2013 at 22:34
Are you getting null in the guid? What is the value you are getting for Membership.GetUser() is that also null ? — Zerotoinfinity
– Zerotoinfinity, Commented Apr 1, 2013 at 22:35

Zerotoinfinity · Accepted Answer · 2013-04-01 22:50:15Z

3

Though Mike has presented you the answer, I would like to draw your attention to use Stored Procedure instead of sql queries

  try
  {
      Guid guid = (Guid)Membership.GetUser().ProviderUserKey;
      string name = TextBoxCategoryName.Text;

       using (SqlConnection con = new SqlConnection(sqlConnection))
            {
            SqlCommand command = new SqlCommand("sp_InsertUserDatails", sqlConnection);
            command.CommandType = CommandType.StoredProcedure;
            command.Parameters.Add("@name", SqlDbType.VarChar).Value = name ;
            command.Parameters.Add("@IdUser", SqlDbType.VarChar).Value = guid ;
            sqlConnection.Open();
            return command.ExecuteNonQuery();
            sqlConnection.Close();
            }
  }
catch (SqlException ex)
  {
     Console.WriteLine("SQL Error" + ex.Message.ToString());
     return 0;
  }

And here goes the Stored procedure

    CREATE PROCEDURE sp_InsertUserDatails 
(
    @name varchar(100),
    @IdUser varchar(100)
)
AS
BEGIN
    insert into dbo.ProfitCategories(name, IdUser) 
    values (@name, @IdUser)
END
GO

edited Apr 1, 2013 at 22:50

answered Apr 1, 2013 at 22:42

Zerotoinfinity

6,57834 gold badges139 silver badges213 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

MikeSmithDev Over a year ago

I'll +1 that for showing code example (even tho you didn't show how to write a SPROC ;)

Zerotoinfinity Over a year ago

@Mike On your suggestion :D .. Now still one thing is left Connection String in web.Config ;)

MikeSmithDev · Accepted Answer · 2013-04-01 22:38:30Z

1

The small problem: You are missing single quotes around your GUID. It should be:

command.CommandText = "insert into ProfitCategories (name, IdUser) values ( '" + name + "', '" + guid + "' )";

But don't do this.

The big problem: You are at risk for SQL injection if you fix like that. Use parameters for your SQL statement to appropriately fix, or use a stored procedure.

Reading:

MSDN SqlCommand.Parameters

SQL Injection

answered Apr 1, 2013 at 22:38

MikeSmithDev

15.8k4 gold badges61 silver badges91 bronze badges

Collectives™ on Stack Overflow

asp.net get current User Id

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related