Thread: Log a user in by CustomerID instead of Email

I am tackling the issue of using unique usernames instead of unique emails.

I've added a Username field to the Customer table and have successfully ported our existing usernames (and passwords) into the database.

I've edited the login process so that it uses these fields respectively (see below).

Everything is working fine, but if duplicate emails exist I am expecting problems.

To solve this, I need help recreating the ValidateUser() method, like so: ValidateUserByID(int customerID, string password); // Validate by ID instead of email.

Code:

// From signin.ascx.cs
// Normal login
{
	int customerID = 0;

	using (SqlConnection dbconn = DB.dbConn())
	{
		dbconn.Open();
		IDataReader rs = DB.GetRS("select CustomerID from Customer where Username='" + txtUsernameField + "';", dbconn);
		rs.Read();
		customerID = Convert.ToInt32(rs["CustomerID"]);
	}

	if(customerID != 0)
		ThisCustomer = new Customer(customerID, true);

	if (ThisCustomer.IsRegistered)
	{
		/* TODO: create ValidateUserByID(int customerID, string password); */
		LoginOK = System.Web.Security.Membership.ValidateUser(ThisCustomer.Email, PasswordField); // This could create problems on dup emails
		
		if (LoginOK)
		{
			// ...
		}
	}
}

If I had the source this wouldn't be an issue, but I'm unsure of where to start otherwise.

Instead of rewriting ValidateUser() I just used CheckLogin() in its place.

Code:

// Solution to the above problem
// normal login
else
{
	int customerID = 0;

	using (SqlConnection dbconn = DB.dbConn())
	{
		dbconn.Open();
		IDataReader rs = DB.GetRS("select CustomerID from Customer where Username='" + txtUsername.Text + "';", dbconn);
		rs.Read();
		customerID = Convert.ToInt32(rs["CustomerID"]);
	}

	ThisCustomer = new Customer(customerID, true);

	if (ThisCustomer.IsRegistered)
	{
                // Use CheckLogin() instead of ValidateUser()
		LoginOK = ThisCustomer.CheckLogin(PasswordField);

		if (LoginOK)
		{
			// user logged in
		}
		else
		{
			// user failed login
		}
	}
	else
	{
		// user does not exist
	}
}

Will this work?