Need help in Login code in asp .net

Question

Hello all, Somebody please help me by modifying this code.In my login page i have three column Login,UserName,Password.In Login i have kept dropdownlist with two list item Admin and User.So when i Select Admin,UserName,Password it should go to desired destination page and when i select User,UserName,Password it should go to another desired destination page.Here is my code. please help me......

Login.aspx:

<asp:Label ID="lblLogin" runat="server" Text="Login" CssClass="Label"></asp:Label>      
<asp:DropDownList ID="DropDownList1" runat="server" AutoPostBack="True">
                                      <asp:ListItem>Admin</asp:ListItem>
                                        <asp:ListItem>User</asp:ListItem>
                                    </asp:DropDownList>            
<asp:Label ID="lblUserName" runat="server" Text="User Name"</asp:Label>                           
                            <asp:TextBox ID="TxtUserName" runat="server" TextMode="SingleLine"></asp:TextBox>                
                            <asp:Label ID="lblPassword" runat="server" Text="Password" CssClass="Label"></asp:Label>                      
                            <asp:TextBox ID="TxtPassword" runat="server" TextMode="Password"></asp:TextBox>                           
                        <td align="center">
                           <asp:Button ID="BtnLogin" runat="server" Text="Login"
                                 onclick="BtnLogin_Click"/>

Login.aspx.cs:

protected void BtnLogin_Click(object sender, EventArgs e)
{
    Session["UserName"] = TxtUserName.Text;  
    Login lg = new Login();        
    if ((lg.GetLogin(TxtUserName.Text, TxtPassword.Text) == 1))
    {
        Response.Redirect("c1.aspx");
    }       
    else
    {           
        Lbl1.Text = "Sorry,Invalid UserName or Password";
    }

Login.cs:

public  class Login
{    public string str = ConfigurationManager.ConnectionStrings["ConnectionString"].ToString();
public int GetLogin(string UserName, string Password)
{
    SqlConnection con = new SqlConnection(str);      
    SqlDataAdapter da = new SqlDataAdapter("select * from Login where UserName='"+UserName+"' and Password='"+Password+"'",con);       
    DataSet ds = new DataSet();
    da.Fill(ds);
    if (ds.Tables[0].Rows.Count > 0)
    {
        if ((ds.Tables[0].Rows[0].ItemArray[1].ToString() == UserName) && (ds.Tables[0].Rows[0].ItemArray[2].ToString() == Password))
        {
            return 1;
        }
        else
        {
            return 0;
        }
    }
    else
    {
        return -1;
    }
}

Thanks, Masum

Answer 1

Firstly, your opening up your application to and SQL injection attack. I would suggest at least using a stored procedure to query the login credentials against your database to minimise this risk.
1st rule of user input - do not trust user input.
It may be worth having a look at this question for further help:

What is the best way to avoid sql injection attacks

As for the problem your requesting help with, surely you just need to make a decision to redirect based on the selected value of the drop down list if the GetLogin() method is succesful.

protected void BtnLogin_Click(object sender, EventArgs e)
{
    Session["UserName"] = TxtUserName.Text;  
    Login lg = new Login();        
    if ((lg.GetLogin(TxtUserName.Text, TxtPassword.Text) == 1))
    {
        if(DropDownList1.SelectedValue == "Admin")
        {
            Response.Redirect("c1.aspx");
        }
        else if(DropDownList1.SelectedValue == "User")
        {
            Response.Redirect("c2.aspx");
        }
    }       
    else
    {           
        Lbl1.Text = "Sorry,Invalid UserName or Password";
    }

Answer 2

You might want to look at implementing Forms Authentication with Role-based security. Then you could redirect based on whether a user has a particular role. Something like -

//if (HttpContext.Current.User.Identity.IsAuthenticated)
//{
    if (User.IsInRole("Administrator"))
    {
    Response.Redirect("myAdminPage.aspx");
    }
    else if (User.IsInRole("User"))
    {
    Response.Redirect("myUserPage.aspx");
    }
//}
    else
    {
    Lbl1.Text = "Sorry,Invalid UserName or Password";
    }