In this video we'll be setting up a logging system for a car and up.
This will require us to make a few changes one to the database and the tool to the overall flow of our
application.
So I'll start off with the database changes are the spring up my management studio and what we need
is a new table which will store the user information so those directly on new on tables go to new table
and then what we want is an I.D. of course which would be of type Integer.
It would be the primary key and we will set it to be identity so it will auto increment and once again
if you're not so familiar with database development then you can check out my course.
My soft askew server for everyone or my askew of database design and mastery so the setting of our I.D.
column we then have the most common user related fields which would be user name which us it does invite
char 50 and password which I will set as an arch R. and I set this one up b a hundred and I'll explain
why I'll also not allow these two to be no as well it doesn't make sense to have a user with neither
use anymore password or either or both must be present for a user to be complete right.
So I just have those three columns for no save this and I'll just call this one.
Users click Okay.
And then we have our new table.
Now some schools of thought would say that you know you want to use that truck.
Exactly which user is doing what.
In your application.
So if that is your desire then what you'd want to do is add foreign keys to your other tables being
types of cars and a car into record so that you can actually see who is interacting with these tables.
What are these records out whatever points.
I wouldn't go that far though I just want a simple logging system so that we can try and restrict access
or application.
So after adding this to the database I have to go back to my code and make a few modifications.
So they've just come out of debug mode and then the first modification I'm going to make is two or EDI
X..
So whenever you make a change to the database you want your and makes or your entity diagram to be aware
of those changes.
So we added a new table so I get this right click go to update model from database then when this comes
up you'll see the ad tab and under the ad tab you noticed that I have an arrow beside tables and is
showing me that I have a new table that is in the database but not in the diagram.
So I can just click users click finish and then it will go ahead and do whatever process it needs to
do with the end result being the addition of the user table to my to my idea makes that I'm right.
So no my application knows and can access the user's table or user properties right.
If I had set up relationships like I said way it sets up the foreign keys between the tables and these
are tip.
Then you would see lines going all around the place because these two are related and the end user would
be related to types of car as well as current record.
But that's that wasn't done.
So here a diagram should look like this.
Of course you build and as you can see my my computer still loading because it's building and we give
it a moment.
And no that's done we can go ahead and design our log in form.
So I'm just going to go back to solution explorer act like our projects go to ad and then I want a new
farm.
And this one is going to be logging.
So I'm just going to call it it's the log in and then I click I'd give it some time to process all of
that.
All right so I went ahead and designed it and I use the same techniques you've been using up until this
point.
I used the label for the label at the top to depict that it's a log in farm.
I use that table labeled and on the left I put the labels for using a my password.
So the write up with the text boxes and then I have to make sure that my ticks boxes have the correct
names.
So I have TB user name and I have TB password right.
So you can the spores of video.
And then I'll force out the log in button at the end of the day.
Taken pause a video here and do your design you know similar to mine if you want if you have a different
vision that's fine.
But at the end of the day we've been learning this so I'm not going to go over the same things are these
basic things over and over and over again because help you call it open you're familiar with it if you're
not then you can review the previous videos and get up to speed with some of these controls and how
they work.
The next step however would be to make sure that the log in button works because once the person provides
username and the password.
The next step is for them to actually log in our click log in.
So of course on click we want to do something.
Now that's something that we're going to want to do involves us interacting with the database and looking
and retrieving the user name and password to make sure that whatever was entered matches what is in
the database.
So by way of testing firstly I'm going to go back to the database and I'm going to add our red card.
So let me just refresh my tables.
Go to my users tables See edit top 200 rows and then I'm going to put in a manual username admin and
the password here is going to be the word password all lowercase and then that's our first user in our
database.
So admin password.
So that means when I get to the log in form if I provide credentials username admin and the password
is the word password.
Then when I click the log in it should be able to look in the database verify that the user name I provided
matches the one that the database.
The password.
Likewise.
And then say yes or no.
I can go through.
All right.
So Mark in our code or like I said we need to interact with the database.
So that means that we need something for that so we can store Private Read only and then our object
of car and entities and call the object on the score be and then I will initialize this on the score
D.B. is equal to a new instance of car rental and it is.
There we go.
Now in the click event I want to wrap it in a traffic get from no.
So just say Try sorry let me try this again.
Try a double tap the C double the top tab and it generates that snippet.
Right.
And then I'll just write up my exception so I'll give a generic arrow.
So it's never a good idea to actually show the exception message to the user.
Like I've said before even though I've done it before I'm just showing you that you can.
But generally speaking you probably don't want to because that means nothing to the user so you just
want to see something went wrong.
Dragon
right so then that's what you want to do.
And then for the trial what we're going to try is to retrieve the values from our farm so I can save
our user name is equal to TB user name dot text and then the same way of our password is equal to TB
password text.
So we've retrieved the user name retrieve the password that the user has entered.
No the thing with the user name is that you may want to terminate a true means that you're taking off
white spaces on either side so I can actually say something like string dot trim
Oh sorry.
No it wouldn't be strewn about trim string does not have that trim function.
You would actually be taxed.
Not true.
Right.
So when we say Trim whatever string value it is our string variable that we see a trim.
Then what it will do is take off any leading whitespace or trailing with whitespace from the user name
because if I wrote my username I write if I wrote space.
All right inadvertently press the space bar while writing or before writing or after writing the user
name then it would not be directed much so you just want to trim it to make sure you don't have any
trailing whitespace or leading whitespace so that the text is more absolute.
During a comparison you don't want to do that with a password though because you want to make sure that
a person puts in the exact text that is in the database that they put into the actual text box art.
So after retrieving the user name and password the next thing I want to do is actually compare this
or try to find something in the database that matches this combination.
So I'm going to say var user which is my object that's I'm going to use to retrieve from my database
and of my users table.
Any record.
So I want one record.
All right.
So a nearby variable user because I'm expecting one record.
There shouldn't be tool users with the same user name and password combination and even if they have
the same password additions of the same user name at any given point.
So I'm expecting only one use it to come back really.
And I'm want to say first order default and then I'm going to throw up a lambda expression and then
I would just say I want the first default user who has a user name that matches the user name I just
got from my text box and say I can use that and then they are just like if I was doing an if statement
and the password in the database there are actually much as the password in the text box.
All right.
So on side with that I'm not going to check if I got but I user or not.
So I say if user is equivalent to no then and if the user is equivalent to no that means after search
the database for the first or default user.
Well default means no.
So for the first user that has the same user name that was entered into the text box and the same password
that was intended into the text box.
If that user comes back as no.
All right.
So if after that operation this is no then we want to say something like please provide valid credentials.
All right.
So as far as we're concerned nobody in the database much is that.
No you don't want to tell them exactly what's wrong as in you don't want to say yes I phoned that user
name but your password might be wrong or vice versa.
Because if it was somebody who is trying to maliciously get into your system you would have solved half
of the equation for them letting them know why they couldn't get you into your application.
All right.
So you want to say if it is no if no user exists like that then you know please provide valid credentials.
We can leave the else blank for no of course that's what would happen if it is if everything is okay
then that's what would happen so I'm just going to see flaws are.
So just for experiment sake just for all we're going to see if it is not correct then the screen should
just give us a message box if it is okay then the screen will just close.
All right.
No if we want this window to come up when we press start then we need to modify or programmed out six.
So right now it's going to launch the main window first.
What I want for the floor if my application is that when you double click that application to run it
it's actually going to launch the log in screen first and then if it launches a log in screen then you
get to an Nah you don't get it you either get further which means you get to the main window which is
our MDI period which we've designed to hold as every other window on functionality of our application
or you're stuck at the log in screen.
All right.
So I wanted to see a launch the log in the window first.
So when the application runs launch log in.
So when I click start then we see our log in window come up.
So if I type in admin 1 and I type in the word password and click the log in then nothing comes up.
All right.
So you see that please provide valid valid credentials and I'll show you exactly how I got these squares.
So you're probably typing inside of it and you're seeing the word password come up and you're seeing
squares going up in mine which just represents the generic card so showing that you know it's obscured
it's masked.
So I want to show you exactly who I am masked mine.
I did send a text box and I did I skip this step of showing you so that's fine I'll go back.
But the point is that when I type in invited credentials it won't let me go further.
If I type in admin and password and I click log in then it closes.
So we see that's our application or our log in logic is working because it went to the database and
it checked and it saw admin as a username password as a password and so it did whatever it was supposed
to do in the else statement.
All right.
So let me just go back to the design quickly initially what what's did to the text box for the text
box to Moss cured your text then what you need to do is provide the password char so why going to password
char and providing I notice it's this char.
So that means give it a symbol.
If you put slashes and slashes will appear if you put an asterisk then the asterisk will up here.
The reason I'm getting squares however is that I changed the font so by changing the funds to my left
I was just experimenting and I changed my to lit.
So what happens is that there is apparently no asterisk in that font right.
So then it just gave you those generic squares to show that well it's masking you would love to use
the asterisk but I don't have an asterisk in this fun so I'm just going to give you the generic square.
So you know the symbol aside the point is that you can mask your text by using that password char because
of course you don't want the word password or the person the sponsor to be in plain text while being
entered into the database.
No.
To fix the flaw.
All we need to say next are sick closer into.
Else what I want to do is actually launch the main window someone to see var mean window is equal to
a new instance of mean window and then I'm going to see.
Well of course my semicolon and I see a mean window that's sure.
All right.
And then I want this window to hide.
So the thing is that let me just show you exactly what's going to happen.
So when I launch my application and then I go ahead and provide valid credentials so ad men and this
word and click log in then it's going to bring up the main window but logging is going to be there lingering
in the background which I don't really want.
It's not that big of a deal.
But what happens is that if I wanted to close the application I would have to close the main window
and then come back and close the log in because they're two entirely different windows.
I didn't see that log in should be an MDI child off the mean window.
All right.
So there are two separate windows and they're both a part of the application.
So as long as they're both running the application would not close.
So what I would want to do is hide.
And the reason I do hide I'm not close is that if I say close here the logging window might actually
close before the main window shows.
All right I've actually seen that happen before.
So I'm going to just say hide.
So that means when I provide valid credentials.
All right.
And then I go ahead and click to log in then it will check the database verify me large the window and
then hide the log in windows so that looks a bit cleaner.
So log in and I'm in my application.
But then when I close this main window notice I'm still in debug mode so debug mode represents that
the application is still running right now which I don't want.
So that means a log in window is still it's hidden and I can't even get to it because it's really hidden
it's not even showing up in my taskbar.
If you're if you're experiencing this right now it won't be showing up in your eyes either.
So I actually have to click stop and that's still not desirable because then that means a process thread
would still be running until that person's computer is shut down.
So we don't want that someone to just modify this code a bit more so that we can see our application
flow a bit better.
So what I want to do is that when I launch my main window I want it to launch with the notion or with
the knowledge of the log in window being somewhere.
So you realize that these forms are kind of autonomous.
So when you launch one or you see Dot show the only time one hears about the other is if it's an MBA
appearance off that one all the children don't care about each other they only know about their MBA
appearance in this situation.
The main window is its own immediate appearance with its own children and the Logan farm is a sibling
meaning it's on the same level as the mean window it's not a child.
And it is I mean window in and of itself even though it's not an MBA appearance.
So the point is that you can't if you have to let one know off the other deliberately.
Right.
But the cool thing is that once you get to one normal the other meaning once I mean window no that there
is a log in window somewhere then I can actually manipulate the log in window through the main window
at any point.
So what I'm going to do is pass is in this declaration of an object I'm going to declare that or pass
in an instance of this or remember that this keyword means that whatever class I'm operating in this
represents I'm object of that class.
So I'm saying I'm passing an object off the log in class are the log in form into me and window.
Now you're seeing that this red line appears because there's no constructor for me in a window that
takes an argument off the log in someone to modify my main window and say just hold on control and click
me and window and it jumps over to that form.
So if you didn't know that or that code or other.
So if it didn't know that shortcut.
No you do.
And then what I want to do is let here know let me know in the law that there is property or give it
up property of type A log in and I'm going to call it underscore the log in.
All right but then I'm also going to create another constructor so see tor me use up my shortcuts here
and then this main window.
This other constructor other is going to take an object called log in and so what.
This one is going to do after initializing components.
Remember you always have to initialize component but then you're all it's also going to initialize my
local and private log in property that I just created.
It's going to initialize it to the value that is coming over in the constructor being initialized here.
All right.
So once again what this allows me to do know is that throw the rest of the code once.
This constructor is used then I have access to the property on the score log in and then I can do what
I want with the log in.
All right.
So all I'm going to do know is say that main window so I'll just bring up my design for main window
and then I'm going to tell the men we know that I wanted to have a closing event tonight so we didn't
put our load events.
No that's fine.
But then I want to say that when you are closing and I'm just going to look very carefully for the closing
events all right just scroll too far down there it is form closing so you have form closed.
And you have form closing.
Write some words to say when you are closing I want you to do something.
So I'm going to double click in that space and I get the form closing event and then all I'm going to
see is that when you are closing I want you to tell the log in object or the log in form that will call
do you initially and passed over itself into your school so that you know about it till it so close.
All right.
So what's going to happen is that when the log in window is going to launch me in the window it's going
to pass over an object off itself into the mean window.
When the main window launches main window will have launched with knowledge of this log in window and
it would be doing whatever it needs to do.
All the children are operating whatever it's doing it's doing but then at the end of the day when it's
closing it will say well when I'm closing I want you to close.
So you log in window you close while I am closing and then everybody's happy.
So let's test and see if that works.
So when I click start and then I log in all right.
So we have main window and we know that we can do whatever we want to do in main window but then when
we click close man window then the expectation is that it closes the log in screen also and Visual Studio
exiting debug mode is proof that our code worked out.
So when that that's one way of setting up a log in form I'm not saying that is the way I've done this
in quite a few ways before but that is certainly one way that you could use and I think this was the
simplest one to show to somebody who's just getting used to wind farms.
But you know some people actually launch it as the MDI child and then you know you get into that vacation
where you have to log into to proceed to get access to the other windows and other menu options you
have a number of ways to implement this kind of flow between your forms now coming back to our log in
farm there's another major modification that we have to make to our application to make it actually
secure because the fact is that if somebody gets access to this database and they look and they see
admin and the word password it's all in plain text.
You never want to store usernames.
Sorry you don't want to store passwords in plain text.
You always want to do what you call an encryption.
So we need to encrypt or you know our password to make sure that if somebody gain access to the database
by whatever means even though we're walking away a shoulder into office when you are doing this work
that they wouldn't be able to decipher what that password is.
So in order to do encryption we need to get the help of some third party libraries.
There are a number of encryption algorithms out there of SHA 2 5 6 you have SHA 1 you have MP 5 you
could go and research them but I'm going to help you get some tools get some help into this project
and then we can do some encryption together.
So what we want to do is go to the solution explore right click our project and then we'll be using
new get monied package manager.
All right.
So this will allow us to browse an open source kind of market place to see what we can get to help us
along the way so I go to bro's it bro's installed and updates.
You saw that you had the entity framework installed which is what allows us to do link and interact
with our database.
But what I'm really interested in is encryption so I can look for encryption all right encryption didn't
really show me anything less stress security.
So sometimes you'll come here you don't necessarily know exactly what you are looking for because there
are so many libraries to choose from but what I'm really looking for is something regarding security
and what I would want.
So you see that idea of quite a few ones here of system.
I thought I just saw Microsoft that nets thought security and no cell phone the one that's I'm interested
in which is system dot Security dot cryptography dot algorithm.
So if you look to the right you'll see a nice description about all the tests to offer.
I'm sorry if it's up here small on my screen but hopefully you're viewing it on your screen and it is
more clear.
But they you'll see that they have a RSA Shah h h Mark M.D. five on a bunch of others.
All right.
So you can actually just click on this one and then the awful.
Of course you want to make sure that you're using there a safe publisher.
So it doesn't get much safer than Microsoft to be in the published ICAC by Microsoft.
So the write off the actual title and if you see Microsoft then you can trust it.
You'll see all the big names that you can trust.
But then the thing is that certain peoples don't mean these libraries and not discrediting them or anything.
But not everyone has their best interests at heart some of them are malicious as much as you get to
me try to weed out the malicious ones they do tell you that they are not responsible for anything that
may happen to you or your product.
What if you don't load anything from them.
Right.
So you want to use this one so you can click this.
That's a black arrow to the right or you can just click install and then you can give it some time nowhere
it's going to go ahead together all dependencies.
It may use more than one libraries and then it's going to download what we'll call the L's which are
like packages that have a bunch of libraries.
So you know every time we write a class how we say using this or using that those actually dials or
libraries full of functions.
Right.
So it's just don't loading a bunch of libraries so you can just say I accept the load to don't load
as many as it may need to.
So we give it some time and then when it's done if you go over to a solution they explore and drop donor
references then you're going to see a bunch of new references.
You probably didn't do this before so you in the state and although the federal system about security
system does security does cryptography that algorithms any of a bunch of others you will also see the
entity framework ones that got our data when we added our EDF mix diagram and so on.
So that's what new gets it brings to the table which allows you to just install a package with those
going and fetching these from all over the internets and trying to inject them into your project manually.
All right.
So now that I've added these algorithms it's time to actually put one to use.
All right.
So I'm going to use the SHA 2 5 6 I think that's a good nice secure one and then I'm going to walk you
through exactly what needs to be done in order to get it to encrypt.
So firstly you always want to encrypt your password one way which means that you're encrypting your
password for storage you're never decrypting your password for comparison.
So that means if I am creating a user right.
If I have a form you know like when you sign up for anything on the Internet and put in a user name
and you would have typed your password in plaintext because you type it the way you know to spell it
when you click submit.
What happens is that that system will take that password and encrypted and save it.
Now after that each time you try to log in it will take whatever you put in that password field and
then encrypt it and then compare this encryption with the stored encryption.
It will never take this stored encryption and try to decrypt it to match it against your plaintext.
All right.
I hope that made sense.
So you always encrypt one way.
So what we need to do here is encrypt the password that is being provided and then compare it against.
Well the password that is being stored.
So there are two things we need to fix.
One day encryption for the comparison and to the actual password being stored.
We need to modify that also.
So firstly I'm going to declare a variable or an object rather and this is going to be of type SHA 2
5 6 no SHA 2 5 6 and then the red line is going to come up because then it doesn't recognize it.
And I'm just going to call it Sha is equal to 2 5 6.
That creates red lines go lower.
Let's see what the red lines have to see.
So if I hover over the the red line or the line with the red line the word with the red line it will
to give me the light bulb but it will tell me that I need to include the use of the library see I need
that statement.
So if I create that follow the guidelines then everything is blue I know it looks more acceptable so
I need to include that library to access the encryption algorithm I'm able to use.
So having made reference to this 2 5 6 and then gotten the username and password from our takes box
the next thing I want to do is compute a hash.
So I'm going to convert the input string to a byte Ari and compute the hash so I'm getting the value
password and passing it into the side of compute hash which does an encoding over it and then it converts
it into a byte area.
So in C sharp that's so you declare an array and then that's the data type and the variable is called
data.
All right.
Having done that we need to construct string.
So first that I need to declare a string builder object.
All right.
So that's I can collect the bytes and create a string with it.
And then after I do that string builder I'm going to use a for loop and then construct that string using
the different data points from the bite.
Ari.
All right.
So let me go through this again.
I'm converting everything converting this string into a byte Ari.
Right call data and then I'm just declaring a string build object so that I can further use it inside
of a for loop where I'm seeing give me I equals zero.
Isaiah should run to the length of the data bytes area whatever length that came up to and increment
accordingly.
And then I'm seeing a string builder just append each subscript in my byte Ari while converting it to
a string.
All right
after doing all of that I'm then going to assign the value to a password or to a variable called hashed
password hard.
So string builder dot to string stirring it as hashed buzzer at the end of this operation whatever it
is you changed you typed sorry in as the password would have been completely changed by the end of this
operation into something that you may not recognize.
I do see a man I recognize I really should say should not recognize some just want to set a breakpoint
right here on the line where I tried to fetch the user and I'm going to show you exactly what the word
gets transformed into.
All right so I typed in admin password and we're at a break point.
So first let me show you the text that I typed in would have been password right.
And then the text that is no hashed looks like this.
No this is not the word password.
Well it really is the word password and that's how it should look in our database such that if somebody
comes along and sees the database there is no way they should be able to tell me that this is the word
password.
All right.
And if I continue with the code where I am no one to look into the database.
Well this will continue because it's still looking for.
Just stop the execution and then what I really should be comparing what's in the database with is the
value that is in hushed password and not password.
No.
If I run this again all right and I'm just removing the breakpoint so if I run this again and try to
log in and I'm trying to compare it deposited into database which is skewed password with the hashed
password then it will be a mismatch because our database is stored in the word password and hash password
does not look anything like the word password.
So then that tells me that the hashed password is what should really be in the database.
So let me just click start again and drive that point home real quickly.
All right.
So I typed in admin and password and I couldn't log in.
And then what it will do is try and compare the hashed password with password and you see these provide
valid credentials.
OK.
So if I just put breakpoint here again and then I attempt this log in and I'm doing that just so I can
get a hold of the value that's is in hushed password.
So I want all of this value excluding the quotation marks of course I want to copy this and then I'm
just going to cheat a little.
I want to go into my database and I'm going to put that hash password as the value.
All right.
So that's one of the reasons I set the password length to be 100 var char 100.
I'm not var to our 50 because that's what the password is supposed to look like in your database.
Nobody should be able to look in the database and see that the admins password is the word password.
Let them see 5 8 8 8 blah blah blah.
And if they've taken the time to memorize all of this they need that life really and truly.
All right.
And then decrypting it won't be the easiest thing in the world either.
So let's illustrate that again so no that's I've changed it's in the database right before the comparison
was done.
When it does the comparison and I click continue then it should proceed.
All right.
So let's try that one more time just to make sure that everything is okay.
So I'm going to once again start and then this is going to launch by log in screen which is going to
prompt me to enter my username and password.
So my username is the word admin and my password is the word password.
See that's what I typed that clicked log in it then hashes that password compares it against what's
in the database realizes that the two words hash to be the same.
And then it proceeds so if I make a spelling error instead of my password then the hash is going to
be different.
And it's not valid.
All right.
So of course when creating users if you want to extend this functionality you know puts in some user
management capabilities in this application when you're creating the user if you are the one setting
the password.
Just make sure that you're going to follow these steps.
This algorithm where you declared the algorithm you're using one and try and use one algorithm throw
at the application.
You don't to use empty five here and shout over there because the hashes will look different and you
may run into problems.
Right.
So always use one hashing algorithm and then you create your byte Ari and then you rebuild that string
based on the different parts that went into the byte area and then you use the hashed password after
that for every other operation.
And that is a quick way to add some log in functionality to your application.