User.Identity for user account page

Question

In my application I use User.Identity to get the username of the user logged in, I was wondering if I can use this to get email and password information as I want a user account page where the user can view there email username etc.. and change their password.

I also have a web service called getusers which gets all the information from the users table in my database but then I am unsure of how to get the account information from the database for the user logged in if I do it this way.

So far I have this:

protected void Page_Load(object sender, EventArgs e)
{
    if (User.Identity.IsAuthenticated)
    {
        username.Text = User.Identity.Name;
    }

    localhost.Service1 myws = new localhost.Service1();
    ds = myws.GetUsers();

}

Which is great because I get the username, but I need the rest.

Oh and here is the web service GetUsers:

[WebMethod]
    public DataSet GetUsers()
    {
        DataSet ds = new DataSet();
        string database = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source=|DataDirectory|/dvd_forum.accdb;Persist Security Info=True";
        string queryStr = "select * from Users";
        OleDbConnection myConn = new OleDbConnection(database);
        OleDbDataAdapter myDataAdapter = new OleDbDataAdapter(queryStr, myConn);
        myConn.Open();
        myDataAdapter.Fill(ds, "Users");
        myConn.Close();
        return ds;
    }

Thanks.

Answer 1

Firstly, I must warn you that your GetUsers() method is open to SQL Injection. That aside...

If you modified that GetUsers() method slightly to accept a parameter and narrow down the search to a unique user, you could have:

[WebMethod] 
public DataSet GetUser(string UserName) 
{ 
    DataSet ds = new DataSet(); 
    string database = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source=|DataDirectory|/dvd_forum.accdb;Persist Security Info=True"; 
    string queryStr = "select * from Users WHERE UserName=" + UserName; 
    OleDbConnection myConn = new OleDbConnection(database); 
    OleDbDataAdapter myDataAdapter = new OleDbDataAdapter(queryStr, myConn); 
    myConn.Open(); 
    myDataAdapter.Fill(ds, "Users"); 
    myConn.Close(); 
    return ds; 
} 

Now all you need to do is call

GetUser(User.Identity.Name);

assuming the username is stored in the database, you'll get your User's record returned in the dataset.

Answer 2

If you are using MembershipUser class in your asp.net application then you can check this link.

Here is a snippet of code.

public void Page_Load(object sender, EventArgs args)
{
  u = Membership.GetUser(User.Identity.Name);

  if (!IsPostBack)
  {
    EmailTextBox.Text = u.Email; 
  }
}