custom authentication to form authentication - asp.net

Question

Currently, my site has a table in a database that contain user name and password. The front end has 2 textboxes and a login button. Once the user fills out those two fields and click login, it will check if user name and password is matched in the database, if so, let them in and set session variable to check through out the entier site. Is this secure enough? How do i convert this to form authentication? I don't want to throw out my login table. Can i still use it if i was to convert this to form authentication? Can anyone point me or show me how this could be done? Thanks

Answer 1

The standard login I use is somethig like this:
index.html:
<form action="login.php" method="post">
<table width="100%" border="0" style = "border-top: 2px solid #CCC; padding-top: 15px;">
<tr>
<td><input type="text" class="text_box" placeholder="Usuario" name="user" id="user"></td>
</tr>
<tr>
<td><input type="password" class="text_box" placeholder="Contraseña" name="pass" id="pass"></td>
</tr>
<tr>
<td>
<?php
show_message();
?>
<input type="submit" value="Ingresar" class="boton_submit">
</td>
</tr>
</table>
</form>
And the php...
<?php
if(isset($_POST["user"]) && isset($_POST["pass"])){
include('conect_to_database.php');
$user = $_POST["user"];
$pass = $_POST["pass"];
if(!filter_var($_POST["user"], FILTER_VALIDATE_EMAIL)) {
//Not a valid email ... sends back to login form
header( 'Location: index.php' ) ;
exit();
}
$query = "SELECT id FROM user where user = ? and pass = ? LIMIT 1";
$stmt = $mysqli->prepare($query);
$stmt->bind_param("ss", $user, $pass);
$stmt->execute();
$stmt->bind_result($id);
while ($stmt->fetch()) {
//set your session variable
header( 'Location: ../../control_panel.php' ) ;
exit();
}
//echo invalid user... sends back to login form
header( 'Location: index.php' ) ;
}
?>
I would also recommend checking for special chars in both user and password.
Also, you should never store passwords in your database. You should just store a hash of the real password using special algorithms.