<authentication mode="Forms">
   <forms name=".ASPXFORMSDEMO" loginUrl="logon.aspx"
   protection="All" path="/" timeout="30" />
</authentication>
                              

<authorization>
   <deny users ="?" />
   <allow users = "*" />
</authorization>
                              

if exists (select * from sysobjects where id =
object_id(N'[dbo].[Users]') and OBJECTPROPERTY(id, N'IsUserTable') = 1)
drop table [dbo].[Users]
GO
CREATE TABLE [dbo].[Users] (
   [uname] [varchar] (15) NOT NULL ,
   [Pwd] [varchar] (25) NOT NULL ,
   [userRole] [varchar] (25) NOT NULL ,
) ON [PRIMARY]
GO
ALTER TABLE [dbo].[Users] WITH NOCHECK ADD
   CONSTRAINT [PK_Users] PRIMARY KEY  NONCLUSTERED
   (
      [uname]
   )  ON [PRIMARY]
GO

INSERT INTO Users values('user1','user1','Manager')
INSERT INTO Users values('user2','user2','Admin')
INSERT INTO Users values('user3','user3','User')
GO
                              

<h3>
   <font face="Verdana">Logon Page</font>
</h3>
<table>
   <tr>
      <td>Email:</td>
      <td><input id="txtUserName" type="text" runat="server"></td>
      <td><ASP:RequiredFieldValidator ControlToValidate="txtUserName"
           Display="Static" ErrorMessage="*" runat="server"
           ID="vUserName" /></td>
   </tr>
   <tr>
      <td>Password:</td>
      <td><input id="txtUserPass" type="password" runat="server"></td>
      <td><ASP:RequiredFieldValidator ControlToValidate="txtUserPass"
          Display="Static" ErrorMessage="*" runat="server"
          ID="vUserPass" />
      </td>
   </tr>
   <tr>
      <td>Persistent Cookie:</td>
      <td><ASP:CheckBox id="chkPersistCookie" runat="server" autopostback="false" /></td>
      <td></td>
   </tr>
</table>
<input type="submit" Value="Logon" runat="server" ID="cmdLogin"><p></p>
<asp:Label id="lblMsg" ForeColor="red" Font-Name="Verdana" Font-Size="10" runat="server" />
                                    

using System.Data.SqlClient;
using System.Web.Security;
                              

private bool ValidateUser( string userName, string passWord )
{
      SqlConnection conn;
      SqlCommand cmd;
      string lookupPassword = null;

      // Check for invalid userName.
      // userName must not be null and must be between 1 and 15 characters.
      if ( (  null == userName ) || ( 0 == userName.Length ) || ( userName.Length > 15 ) )
      {
            System.Diagnostics.Trace.WriteLine( "[ValidateUser] Input validation of userName failed." );
            return false;
      }

      // Check for invalid passWord.
      // passWord must not be null and must be between 1 and 25 characters.
      if ( (  null == passWord ) || ( 0 == passWord.Length ) || ( passWord.Length > 25 ) )
      {
            System.Diagnostics.Trace.WriteLine( "[ValidateUser] Input validation of passWord failed." );
            return false;
      }

      try
      {
            // Consult with your SQL Server administrator for an appropriate connection
            // string to use to connect to your local SQL Server.
            conn = new SqlConnection( "server=localhost;Integrated Security=SSPI;database=pubs" );
            conn.Open();

            // Create SqlCommand to select pwd field from users table given supplied userName.
            cmd = new SqlCommand( "Select pwd from users where uname=@userName", conn );
            cmd.Parameters.Add( "@userName", SqlDbType.VarChar, 25 );
            cmd.Parameters["@userName"].Value = userName;

            // Execute command and fetch pwd field into lookupPassword string.
            lookupPassword = (string) cmd.ExecuteScalar();

            // Cleanup command and connection objects.
            cmd.Dispose();
            conn.Dispose();
      }
      catch ( Exception ex )
      {
            // Add error handling here for debugging.
            // This error message should not be sent back to the caller.
            System.Diagnostics.Trace.WriteLine( "[ValidateUser] Exception " + ex.Message );
      }

      // If no password found, return false.
      if ( null == lookupPassword )
      {
            // You could write failed login attempts here to event log for additional security.
            return false;
      }

      // Compare lookupPassword and input passWord, using a case-sensitive comparison.
      return ( 0 == string.Compare( lookupPassword, passWord, false ) );

}
                              

this.cmdLogin.ServerClick += new System.EventHandler(this.cmdLogin_ServerClick);
                              

<input type="submit" Value="SignOut" runat="server" id="cmdSignOut">
                                    

using System.Web.Security;
                              

private void cmdSignOut_ServerClick(object sender, System.EventArgs e)
{
   FormsAuthentication.SignOut();
   Response.Redirect("logon.aspx", true);
}
                              

this.cmdSignOut.ServerClick += new System.EventHandler(this.cmdSignOut_ServerClick);