?using System;
using System.Data;
using System.Configuration;
using System.Collections;
using System.Web;
using System.Web.Security;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Web.UI.WebControls.WebParts;
using System.Web.UI.HtmlControls;
using System.Data.SqlClient;

public partial class user_user_update_password : System.Web.UI.Page
{
    string answer;
    int userid;
    protected void Page_Load(object sender, EventArgs e)
    {
        if (Session["userid"] == null)
            Response.Redirect("~/user/userLogin.aspx?url="+Server .HtmlEncode(Request .RawUrl ));
        else
            userid = Convert.ToInt32(Session["userid"].ToString());

        if (!IsPostBack) lb_message.Text = setValue();
    }

    private string setValue()
    {

        string strconn = ConfigurationManager.ConnectionStrings["dsn"].ToString();
        SqlConnection cn = new SqlConnection(strconn);
        string sql = "select username,question,answer from users where userid=" + this. userid;

        try
        {
            cn.Open();
            SqlCommand cm = new SqlCommand(sql, cn);
            SqlDataReader dr = cm.ExecuteReader();

            //如果讀到記錄，根據用戶id取得用戶信息
            if (dr.Read())
            {
                lb_username.Text = dr["username"].ToString();
                lb_question.Text = dr["question"].ToString();
                this.answer = dr["answer"].ToString(); 
                return "";
            }
            else
                return "無信息";

        }
        catch (Exception ex)
        {
            return ex.Message;
        }
        finally
        {
            cn.Close();
        }
    }
    protected void btn_updatePwd_Click(object sender, EventArgs e)
    {
        setValue();
        lb_message.Text =updatePwd ();
        
    }

    private string updatePwd()
    {
        if (tb_newpass.Text.Length < 6)
           return "您輸入的密碼位數太短";

        if ( Server .HtmlEncode (tb_answer .Text )==this.answer )
        {
            string strconn = ConfigurationManager.ConnectionStrings["dsn"].ToString();
            SqlConnection cn = new SqlConnection(strconn);

            string password = Server.HtmlEncode(FormsAuthentication.HashPasswordForStoringInConfigFile
                (tb_newpass.Text.ToString(), "SHA1"));

            string sql = "update users set password='" + password + "' where userid= " + userid;
            try
            {
                cn.Open();
                SqlCommand cm = new SqlCommand(sql, cn);
                cm.ExecuteNonQuery();
                return "更新密碼成功！";
            }
            catch (SqlException ex)
            {
                return ex.Message;
            }
            finally
            {
                cn.Close();
            }
        }
        else
            return  "你回答錯誤了";
    }

}