How to make custom password change control in asp.net

Introduction

This control is designed for authenticated user, he/she can change own profile password. Basically, it have three fields, such as old password field, New password field, and retype password field. Looking like

If your old password doesn't match with stored data then new password will not update. Id password match with stored data then your new password will be updated.

Algorithm behind the program

Step-1 : First of all match your old password with table data using user_id, which is unique. For that, we will create a SELECT query.
Step-2 : Result of Select Query match with Text Box, which is defined for old password.
Step-3 : If Your inputted password is matched with fetched data, which is fetched from select query.
Step-4 : Design update query and will change your old password with new one.

Programming code

Step-1 : Create connection from SqlEngine using SqlConnection class, which is inside in System. Data. SqlClient namespace.

SqlConnection con;
con = new SqlConnection();
con.ConnectionString = ConfigurationManager.ConnectionStrings["ConnectionString"].ToString();

Step-2 : After establishing connection, check data which is inside in database table. Check data using SqlDataReader , if data is already exist in table, will not update new password with old. If doesn't exist data in table , update database table

private void checkold()
{
con.Open();
cmd.CommandText = "select * from Register";
cmd.Connection = con;
rd = cmd.ExecuteReader();
while (rd.Read())
{
if (rd["Password"].ToString() == oldpwd.Text && rd["Email"].ToString() == Session["email"].ToString ())
{
flag = false;
break;
}

}
if (flag == false)
{
con.Close();
updatepassword();
}
else
{
Label1.Text = "Password doesn't match";
Label1.ForeColor = System.Drawing.Color.Red;
}
}

Step-3 : Update database table with new one password

private void updatepassword()
{
con.Open();
cmd.CommandText = "update register set Password=@pass where email=@em";
cmd.Parameters.AddWithValue("@pass", pass.Text);
cmd.Parameters.AddWithValue("@em", Session["email"].ToString());
cmd.Connection = con;
int update = cmd.ExecuteNonQuery();
if (update >0)
{
Label1.Text = "Password Update";
Label1.ForeColor = System.Drawing.Color.Green;
}
else
{

Label1.Text = "Error";
Label1.ForeColor = System.Drawing.Color.Yellow;

}
}