projects / mono.git / blobdiff
? search:
summary | shortlog | log | commit | commitdiff | tree
raw | inline | side by side
Simple content restriction was not validated when it is in further reference.
[mono.git] / mcs / class / Mainsoft.Web / Mainsoft.Web.Security / DerbyMembershipHelper.cs
diff --git a/mcs/class/Mainsoft.Web/Mainsoft.Web.Security/DerbyMembershipHelper.cs b/mcs/class/Mainsoft.Web/Mainsoft.Web.Security/DerbyMembershipHelper.cs
index 10122b165a5b56b187dcbbd19d2ab38f0ee903ce..c16c4bb9b0ba5dbf92d60a9a7f0752b436037c34 100644 (file)
--- a/mcs/class/Mainsoft.Web/Mainsoft.Web.Security/DerbyMembershipHelper.cs
+++ b/mcs/class/Mainsoft.Web/Mainsoft.Web.Security/DerbyMembershipHelper.cs
@@ -106,7 +106,7 @@ namespace Mainsoft.Web.Security
                                        OleDbCommand cmdMbrEmail = new OleDbCommand (queryMbrEmail, (OleDbConnection) connection);\r
                                        cmdMbrEmail.Transaction = trans;\r
                                        AddParameter (cmdMbrEmail, "ApplicationId", applicationId);\r
-                                       AddParameter (cmdMbrEmail, "LoweredEmail", email.ToLower ());\r
+                                       AddParameter (cmdMbrEmail, "LoweredEmail", email.ToLowerInvariant ());\r
                                        using (OleDbDataReader reader = cmdMbrEmail.ExecuteReader ()) {\r
                                                if (reader.Read ()) {\r
                                                        trans.Rollback ();\r
@@ -128,8 +128,8 @@ namespace Mainsoft.Web.Security
 \r
                                string queryInsertMbr = "INSERT INTO aspnet_Membership (ApplicationId, UserId, Password, PasswordFormat, PasswordSalt, Email, " +\r
                                        "LoweredEmail, PasswordQuestion, PasswordAnswer, IsApproved, IsLockedOut, CreateDate, LastLoginDate, " +\r
-                                       "LastPasswordChangedDate, LastLockoutDate, FailedPasswordAttemptCount, FailedPasswordAttemptWindowStart, " +\r
-                                       "FailedPasswordAnswerAttemptCount, FailedPasswordAnswerAttemptWindowStart) " +\r
+                                       "LastPasswordChangedDate, LastLockoutDate, FailedPasswordAttemptCount, FailedPwdAttemptWindowStart, " +\r
+                                       "FailedPwdAnswerAttemptCount, FailedPwdAnswerAttWindowStart) " +\r
                                        "VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)";\r
                                OleDbCommand cmdInsertMbr = new OleDbCommand (queryInsertMbr, (OleDbConnection) connection);\r
                                cmdInsertMbr.Transaction = trans;\r
@@ -139,7 +139,7 @@ namespace Mainsoft.Web.Security
                                AddParameter (cmdInsertMbr, "PasswordFormat", passwordFormat);\r
                                AddParameter (cmdInsertMbr, "PasswordSalt", passwordSalt);\r
                                AddParameter (cmdInsertMbr, "Email", email);\r
-                               AddParameter (cmdInsertMbr, "LoweredEmail", email != null ? email.ToLower () : null);\r
+                               AddParameter (cmdInsertMbr, "LoweredEmail", email != null ? email.ToLowerInvariant () : null);\r
                                AddParameter (cmdInsertMbr, "PasswordQuestion", pwdQuestion);\r
                                AddParameter (cmdInsertMbr, "PasswordAnswer", pwdAnswer);\r
                                AddParameter (cmdInsertMbr, "IsApproved", isApproved);\r
@@ -149,9 +149,9 @@ namespace Mainsoft.Web.Security
                                AddParameter (cmdInsertMbr, "LastPasswordChangedDate", createDate);\r
                                AddParameter (cmdInsertMbr, "LastLockoutDate", DefaultDateTime);\r
                                AddParameter (cmdInsertMbr, "FailedPasswordAttemptCount", 0);\r
-                               AddParameter (cmdInsertMbr, "FailedPasswordAttemptWindowStart", DefaultDateTime);\r
-                               AddParameter (cmdInsertMbr, "FailedPasswordAnswerAttemptCount", 0);\r
-                               AddParameter (cmdInsertMbr, "FailedPasswordAnswerAttemptWindowStart", DefaultDateTime);\r
+                               AddParameter (cmdInsertMbr, "FailedPwdAttemptWindowStart", DefaultDateTime);\r
+                               AddParameter (cmdInsertMbr, "FailedPwdAnswerAttemptCount", 0);\r
+                               AddParameter (cmdInsertMbr, "FailedPwdAnswerAttWindowStart", DefaultDateTime);\r
                                cmdInsertMbr.ExecuteNonQuery ();\r
 \r
                                trans.Commit ();\r
@@ -171,7 +171,7 @@ namespace Mainsoft.Web.Security
                                "FROM aspnet_Membership mbr, aspnet_Users usr " +\r
                                "WHERE usr.UserId = mbr.UserId AND mbr.LoweredEmail LIKE ? ORDER BY usr.LoweredUserName";\r
                        OleDbCommand cmdSelect = new OleDbCommand (querySelect, (OleDbConnection) connection);\r
-                       AddParameter (cmdSelect, "LoweredEmail", emailToMatch.ToLower ());\r
+                       AddParameter (cmdSelect, "LoweredEmail", emailToMatch.ToLowerInvariant ());\r
                        reader = cmdSelect.ExecuteReader ();\r
                        return 0;\r
                }\r
@@ -183,7 +183,7 @@ namespace Mainsoft.Web.Security
                                "FROM aspnet_Membership mbr, aspnet_Users usr " +\r
                                "WHERE usr.UserId = mbr.UserId AND usr.LoweredUserName LIKE ? ORDER BY usr.LoweredUserName";\r
                        OleDbCommand cmdSelect = new OleDbCommand (querySelect, (OleDbConnection) connection);\r
-                       AddParameter (cmdSelect, "LoweredUserName", userNameToMatch.ToLower ());\r
+                       AddParameter (cmdSelect, "LoweredUserName", userNameToMatch.ToLowerInvariant ());\r
                        reader = cmdSelect.ExecuteReader ();\r
                        return 0;\r
                }\r
@@ -201,14 +201,14 @@ namespace Mainsoft.Web.Security
 \r
                public static int Membership_GetNumberOfUsersOnline (DbConnection connection, string applicationName, int minutesSinceLastInActive, DateTime currentTimeUtc)\r
                {\r
-                       string queryUsersActive = "SELECT COUNT(*) FROM aspnet_Users usr, aspnet_Applications app, aspnet_Membership mbr " +
-                               "WHERE usr.ApplicationId = app.ApplicationId AND usr.LastActivityDate > ? AND " +
+                       string queryUsersActive = "SELECT COUNT(*) FROM aspnet_Users usr, aspnet_Applications app, aspnet_Membership mbr " +\r
+                               "WHERE usr.ApplicationId = app.ApplicationId AND usr.LastActivityDate > ? AND " +\r
                                "app.LoweredApplicationName = ? AND usr.UserId = mbr.UserId";\r
 \r
 \r
                        OleDbCommand cmdUsersActive = new OleDbCommand (queryUsersActive, (OleDbConnection) connection);\r
                        AddParameter (cmdUsersActive, "LastActivityDate", currentTimeUtc.AddMinutes (-minutesSinceLastInActive));\r
-                       AddParameter (cmdUsersActive, "LoweredApplicationName", applicationName.ToLower ());\r
+                       AddParameter (cmdUsersActive, "LoweredApplicationName", applicationName.ToLowerInvariant ());\r
                        using (OleDbDataReader reader = cmdUsersActive.ExecuteReader ()) {\r
                                if (reader.Read ())\r
                                        return reader.GetInt32 (0);\r
@@ -219,13 +219,13 @@ namespace Mainsoft.Web.Security
                public static int Membership_GetPassword (DbConnection connection, string applicationName, string username, string passwordAnswer, int maxInvalidPasswordAttempts, int passwordAttemptWindow, DateTime currentTimeUtc, out string password)\r
                {\r
                        string querySelect = "SELECT usr.UserId, mbr.Password, mbr.PasswordAnswer, mbr.IsLockedOut, " +\r
-                               "mbr.LastLockoutDate, mbr.FailedPasswordAnswerAttemptCount, mbr.FailedPasswordAnswerAttemptWindowStart " +\r
+                               "mbr.LastLockoutDate, mbr.FailedPwdAnswerAttemptCount, mbr.FailedPwdAnswerAttWindowStart " +\r
                                "FROM aspnet_Applications app, aspnet_Users usr, aspnet_Membership mbr " +\r
                                "WHERE app.LoweredApplicationName = ? AND usr.ApplicationId = app.ApplicationId " +\r
                                "AND usr.UserId = mbr.UserId AND usr.LoweredUserName = ?";\r
                        OleDbCommand cmdSelect = new OleDbCommand (querySelect, (OleDbConnection) connection);\r
-                       AddParameter (cmdSelect, "LoweredApplicationName", applicationName.ToLower ());\r
-                       AddParameter (cmdSelect, "LoweredUserName", username.ToLower ());\r
+                       AddParameter (cmdSelect, "LoweredApplicationName", applicationName.ToLowerInvariant ());\r
+                       AddParameter (cmdSelect, "LoweredUserName", username.ToLowerInvariant ());\r
 \r
                        password = null;\r
                        string dbUserId = null;\r
@@ -277,13 +277,13 @@ namespace Mainsoft.Web.Security
                        }\r
 \r
                        string queryUpdate = "UPDATE aspnet_Membership SET IsLockedOut = ?, LastLockoutDate = ?, " +\r
-                               "FailedPasswordAnswerAttemptCount = ?, FailedPasswordAnswerAttemptWindowStart = ? " +\r
+                               "FailedPwdAnswerAttemptCount = ?, FailedPwdAnswerAttWindowStart = ? " +\r
                                "WHERE UserId = ?";\r
                        OleDbCommand cmdUpdate = new OleDbCommand (queryUpdate, (OleDbConnection) connection);\r
                        AddParameter (cmdUpdate, "IsLockedOut", dbLockedOut);\r
                        AddParameter (cmdUpdate, "LastLockoutDate", dbLastLockoutDate);\r
-                       AddParameter (cmdUpdate, "FailedPasswordAnswerAttemptCount", dbFailedPasswordAnswerAttemptCount);\r
-                       AddParameter (cmdUpdate, "FailedPasswordAnswerAttemptWindowStart", dbFailedPasswordAnswerAttemptWindowStart);\r
+                       AddParameter (cmdUpdate, "FailedPwdAnswerAttemptCount", dbFailedPasswordAnswerAttemptCount);\r
+                       AddParameter (cmdUpdate, "FailedPwdAnswerAttWindowStart", dbFailedPasswordAnswerAttemptWindowStart);\r
                        AddParameter (cmdUpdate, "UserId", dbUserId);\r
                        cmdUpdate.ExecuteNonQuery ();\r
                        \r
@@ -293,13 +293,13 @@ namespace Mainsoft.Web.Security
                public static int Membership_GetPasswordWithFormat (DbConnection connection, string applicationName, string username, bool updateLastActivity, DateTime currentTimeUtc, out DbDataReader reader)\r
                {\r
                        string querySelect = "SELECT usr.UserId, mbr.IsLockedOut, mbr.IsApproved, mbr.Password, mbr.PasswordFormat, mbr.PasswordSalt, " +\r
-                               "mbr.FailedPasswordAttemptCount, mbr.FailedPasswordAnswerAttemptCount, mbr.LastLoginDate, usr.LastActivityDate " +\r
+                               "mbr.FailedPasswordAttemptCount, mbr.FailedPwdAnswerAttemptCount, mbr.LastLoginDate, usr.LastActivityDate " +\r
                                "FROM aspnet_Applications app, aspnet_Users usr, aspnet_Membership mbr " +\r
                                "WHERE app.LoweredApplicationName = ? AND usr.ApplicationId = app.ApplicationId " +\r
                                "AND usr.UserId = mbr.UserId AND usr.LoweredUserName = ?";\r
                        OleDbCommand cmdSelect = new OleDbCommand (querySelect, (OleDbConnection) connection);\r
-                       AddParameter (cmdSelect, "LoweredApplicationName", applicationName.ToLower ());\r
-                       AddParameter (cmdSelect, "LoweredUserName", username.ToLower ());\r
+                       AddParameter (cmdSelect, "LoweredApplicationName", applicationName.ToLowerInvariant ());\r
+                       AddParameter (cmdSelect, "LoweredUserName", username.ToLowerInvariant ());\r
                        reader = cmdSelect.ExecuteReader ();\r
                        return 0;\r
                }\r
@@ -311,9 +311,9 @@ namespace Mainsoft.Web.Security
                                "usr.UserId = mbr.UserId AND mbr.LoweredEmail " + (email == null ? "IS NULL" : "= ?");\r
 \r
                        OleDbCommand cmdSelect = new OleDbCommand (querySelect, (OleDbConnection) connection);\r
-                       AddParameter (cmdSelect, "LoweredApplicationName", applicationName.ToLower ());\r
+                       AddParameter (cmdSelect, "LoweredApplicationName", applicationName.ToLowerInvariant ());\r
                        if (email != null)\r
-                               AddParameter (cmdSelect, "LoweredEmail", email.ToLower ());\r
+                               AddParameter (cmdSelect, "LoweredEmail", email.ToLowerInvariant ());\r
 \r
                        username = null;\r
                        using (OleDbDataReader reader = cmdSelect.ExecuteReader ()) {\r
@@ -361,9 +361,9 @@ namespace Mainsoft.Web.Security
                                        return 1; // user not found\r
                        }\r
 \r
-                       string querySelect = "SELECT usr.UserName, mbr.UserId, mbr.Email, mbr.PasswordQuestion, mbr.Comment, mbr.IsApproved, " + 
-                               "mbr.IsLockedOut, mbr.CreateDate, mbr.LastLoginDate, usr.LastActivityDate, mbr.LastPasswordChangedDate, mbr.LastLockoutDate " +
-                               "FROM aspnet_Users usr, aspnet_Membership mbr " +
+                       string querySelect = "SELECT usr.UserName, mbr.UserId, mbr.Email, mbr.PasswordQuestion, mbr.Comment, mbr.IsApproved, " + \r
+                               "mbr.IsLockedOut, mbr.CreateDate, mbr.LastLoginDate, usr.LastActivityDate, mbr.LastPasswordChangedDate, mbr.LastLockoutDate " +\r
+                               "FROM aspnet_Users usr, aspnet_Membership mbr " +\r
                                "WHERE usr.UserId = ? AND usr.UserId = mbr.UserId";\r
                        OleDbCommand cmdSelect = new OleDbCommand (querySelect, (OleDbConnection) connection);\r
                        AddParameter (cmdSelect, "UserId", userId);\r
@@ -374,13 +374,13 @@ namespace Mainsoft.Web.Security
                public static int Membership_ResetPassword (DbConnection connection, string applicationName, string username, string newPassword, string passwordAnswer, int passwordFormat, string passwordSalt, int maxInvalidPasswordAttempts, int passwordAttemptWindow, DateTime currentTimeUtc)\r
                {\r
                        string querySelect = "SELECT usr.UserId, mbr.Password, mbr.PasswordAnswer, mbr.IsLockedOut, " +\r
-                               "mbr.LastLockoutDate, mbr.FailedPasswordAnswerAttemptCount, mbr.FailedPasswordAnswerAttemptWindowStart " +\r
+                               "mbr.LastLockoutDate, mbr.FailedPwdAnswerAttemptCount, mbr.FailedPwdAnswerAttWindowStart " +\r
                                "FROM aspnet_Applications app, aspnet_Users usr, aspnet_Membership mbr " +\r
                                "WHERE app.LoweredApplicationName = ? AND usr.ApplicationId = app.ApplicationId " +\r
                                "AND usr.UserId = mbr.UserId AND usr.LoweredUserName = ?";\r
                        OleDbCommand cmdSelect = new OleDbCommand (querySelect, (OleDbConnection) connection);\r
-                       AddParameter (cmdSelect, "LoweredApplicationName", applicationName.ToLower ());\r
-                       AddParameter (cmdSelect, "LoweredUserName", username.ToLower ());\r
+                       AddParameter (cmdSelect, "LoweredApplicationName", applicationName.ToLowerInvariant ());\r
+                       AddParameter (cmdSelect, "LoweredUserName", username.ToLowerInvariant ());\r
 \r
                        string dbUserId = null;\r
                        string dbPassword = null;\r
@@ -463,12 +463,12 @@ namespace Mainsoft.Web.Security
                                return 1; // user not found\r
 \r
                        string queryUnlock = "UPDATE aspnet_Membership SET IsLockedOut = 0, " +\r
-                               "FailedPasswordAttemptCount = 0, FailedPasswordAttemptWindowStart = ?, " +\r
-                               "FailedPasswordAnswerAttemptCount = 0, FailedPasswordAnswerAttemptWindowStart = ?, " +\r
+                               "FailedPasswordAttemptCount = 0, FailedPwdAttemptWindowStart = ?, " +\r
+                               "FailedPwdAnswerAttemptCount = 0, FailedPwdAnswerAttWindowStart = ?, " +\r
                                "LastLockoutDate = ? WHERE UserId = ?";\r
                        OleDbCommand cmdUnlock = new OleDbCommand (queryUnlock, (OleDbConnection) connection);\r
-                       AddParameter (cmdUnlock, "FailedPasswordAttemptWindowStart", DefaultDateTime);\r
-                       AddParameter (cmdUnlock, "FailedPasswordAnswerAttemptWindowStart", DefaultDateTime);\r
+                       AddParameter (cmdUnlock, "FailedPwdAttemptWindowStart", DefaultDateTime);\r
+                       AddParameter (cmdUnlock, "FailedPwdAnswerAttWindowStart", DefaultDateTime);\r
                        AddParameter (cmdUnlock, "LastLockoutDate", DefaultDateTime);\r
                        AddParameter (cmdUnlock, "UserId", userId);\r
 \r
@@ -503,7 +503,7 @@ namespace Mainsoft.Web.Security
                                "IsApproved = ?, LastLoginDate = ? WHERE UserId = ?";\r
                        OleDbCommand cmdUpdateMember = new OleDbCommand (queryUpdateMember, (OleDbConnection) connection);\r
                        AddParameter (cmdUpdateMember, "Email", email);\r
-                       AddParameter (cmdUpdateMember, "LoweredEmail", email.ToLower ());\r
+                       AddParameter (cmdUpdateMember, "LoweredEmail", email.ToLowerInvariant ());\r
                        AddParameter (cmdUpdateMember, "Comment", comment);\r
                        AddParameter (cmdUpdateMember, "IsApproved", isApproved);\r
                        AddParameter (cmdUpdateMember, "LastLoginDate", lastLoginDate);\r
@@ -516,13 +516,13 @@ namespace Mainsoft.Web.Security
                public static int Membership_UpdateUserInfo (DbConnection connection, string applicationName, string username, bool isPasswordCorrect, bool updateLastLoginActivityDate, int maxInvalidPasswordAttempts, int passwordAttemptWindow, DateTime currentTimeUtc, DateTime lastLoginDate, DateTime lastActivityDate)\r
                {\r
                        string querySelect = "SELECT usr.UserId, mbr.IsApproved, mbr.IsLockedOut, mbr.LastLockoutDate, " +\r
-                                                       "mbr.FailedPasswordAttemptCount, mbr.FailedPasswordAttemptWindowStart " +\r
+                                                       "mbr.FailedPasswordAttemptCount, mbr.FailedPwdAttemptWindowStart " +\r
                                                        "FROM aspnet_Applications app, aspnet_Users usr, aspnet_Membership mbr " +\r
                                                        "WHERE app.LoweredApplicationName = ? AND usr.ApplicationId = app.ApplicationId " +\r
                                                        "AND usr.UserId = mbr.UserId AND usr.LoweredUserName = ?";\r
                        OleDbCommand cmdSelect = new OleDbCommand (querySelect, (OleDbConnection) connection);\r
-                       AddParameter (cmdSelect, "LoweredApplicationName", applicationName.ToLower ());\r
-                       AddParameter (cmdSelect, "LoweredUserName", username.ToLower ());\r
+                       AddParameter (cmdSelect, "LoweredApplicationName", applicationName.ToLowerInvariant ());\r
+                       AddParameter (cmdSelect, "LoweredUserName", username.ToLowerInvariant ());\r
 \r
                        string dbUserId = string.Empty;\r
                        bool dbIsApproved = false;\r
@@ -583,13 +583,13 @@ namespace Mainsoft.Web.Security
                        }\r
 \r
                        string queryUpdate = "UPDATE aspnet_Membership SET IsLockedOut = ?, LastLockoutDate = ?, " +\r
-                               "FailedPasswordAttemptCount = ?, FailedPasswordAttemptWindowStart = ? " +\r
+                               "FailedPasswordAttemptCount = ?, FailedPwdAttemptWindowStart = ? " +\r
                                "WHERE UserId = ?";\r
                        OleDbCommand cmdUpdate = new OleDbCommand (queryUpdate, (OleDbConnection) connection);\r
                        AddParameter (cmdUpdate, "IsLockedOut", dbLockedOut);\r
                        AddParameter (cmdUpdate, "LastLockoutDate", dbLastLockoutDate);\r
                        AddParameter (cmdUpdate, "FailedPasswordAttemptCount", dbFailedPasswordAttemptCount);\r
-                       AddParameter (cmdUpdate, "FailedPasswordAttemptWindowStart", dbFailedPasswordAttemptWindowStart);\r
+                       AddParameter (cmdUpdate, "FailedPwdAttemptWindowStart", dbFailedPasswordAttemptWindowStart);\r
                        AddParameter (cmdUpdate, "UserId", dbUserId);\r
                        cmdUpdate.ExecuteNonQuery ();\r
                        return 0;\r
@@ -599,7 +599,7 @@ namespace Mainsoft.Web.Security
                {\r
                        string selectQuery = "SELECT UserId FROM aspnet_Users WHERE LoweredUserName = ? AND ApplicationId = ?";\r
                        OleDbCommand selectCmd = new OleDbCommand (selectQuery, (OleDbConnection) connection);\r
-                       AddParameter (selectCmd, "LoweredUserName", username.ToLower ());\r
+                       AddParameter (selectCmd, "LoweredUserName", username.ToLowerInvariant ());\r
                        AddParameter (selectCmd, "ApplicationId", applicationId);\r
                        if (trans != null)\r
                                selectCmd.Transaction = (OleDbTransaction) trans;\r
@@ -636,7 +636,7 @@ namespace Mainsoft.Web.Security
                        AddParameter (insertCmd, "ApplicationId", applicationId);\r
                        AddParameter (insertCmd, "UserId", userId);\r
                        AddParameter (insertCmd, "UserName", username);\r
-                       AddParameter (insertCmd, "LoweredUserName", username.ToLower ());\r
+                       AddParameter (insertCmd, "LoweredUserName", username.ToLowerInvariant ());\r
                        AddParameter (insertCmd, "IsAnonymous", isAnonymous);\r
                        AddParameter (insertCmd, "LastActivityDate", lastActivityDate);\r
                        if (trans != null)\r
@@ -686,15 +686,16 @@ namespace Mainsoft.Web.Security
                                        numTablesDeletedFrom++;\r
                                }\r
 \r
-                               if ((tablesToDeleteFrom & 8) == 8) {\r
-                                       string queryDelete = "DELETE FROM aspnet_PersonalizationPerUser WHERE UserId = ?";\r
-                                       OleDbCommand cmdDelete = new OleDbCommand (queryDelete, (OleDbConnection) connection);\r
-                                       AddParameter (cmdDelete, "UserId", userId);\r
-                                       cmdDelete.Transaction = trans;\r
-                                       cmdDelete.ExecuteNonQuery ();\r
+                               // this table was removed  from schema\r
+                               //if ((tablesToDeleteFrom & 8) == 8) {\r
+                               //    string queryDelete = "DELETE FROM aspnet_PersonalizationPerUser WHERE UserId = ?";\r
+                               //    OleDbCommand cmdDelete = new OleDbCommand (queryDelete, (OleDbConnection) connection);\r
+                               //    AddParameter (cmdDelete, "UserId", userId);\r
+                               //    cmdDelete.Transaction = trans;\r
+                               //    cmdDelete.ExecuteNonQuery ();\r
 \r
-                                       numTablesDeletedFrom++;\r
-                               }\r
+                               //    numTablesDeletedFrom++;\r
+                               //}\r
 \r
                                if ((tablesToDeleteFrom & 15) == 15) {\r
                                        string queryDelete = "DELETE FROM aspnet_Users WHERE UserId = ?";\r
@@ -720,12 +721,12 @@ namespace Mainsoft.Web.Security
                {\r
                        string selectQuery = "SELECT usr.UserId FROM aspnet_Membership mbr, aspnet_Users usr, aspnet_Applications app WHERE " +\r
                                "usr.LoweredUserName = ? AND app.LoweredApplicationName = ? " +\r
-                               "AND app.ApplicationId = usr.app.ApplicationId " +\r
+                               "AND usr.ApplicationId = app.ApplicationId " +\r
                                "AND usr.UserId = mbr.UserId";\r
 \r
                        OleDbCommand selectCmd = new OleDbCommand (selectQuery, (OleDbConnection) connection);\r
-                       AddParameter (selectCmd, "LoweredUserName", username.ToLower ());\r
-                       AddParameter (selectCmd, "PasswordAnswer", applicationName.ToLower ());\r
+                       AddParameter (selectCmd, "LoweredUserName", username.ToLowerInvariant ());\r
+                       AddParameter (selectCmd, "PasswordAnswer", applicationName.ToLowerInvariant ());\r
 \r
                        using (OleDbDataReader reader = selectCmd.ExecuteReader ()) {\r
                                if (reader.Read ())\r
my mono mirror. check out Moved to http://github.com/mono/mono