2

What is this witch craft?

How does a textbox type password know the length of the password for each user without it being bound?

I stumbled across this phenomena for the first time today and an amazed and puzzled as to what is happeneing?

I have tried to elimate user error by creating a stand alone page just to test this. Basic page structure aside this is all the code on the page.

ASP.NET

<asp:TextBox ID="txtUsername" runat="server" />
<asp:TextBox ID="txtPassword" runat="server" TextMode="Password"/>

VB.NET

Using con As New SqlConnection
  con.ConnectionString = ConfigurationManager.ConnectionStrings("Con").ConnectionString
  Using cmd As New SqlCommand("TM.sp", con)
    cmd.CommandType = CommandType.StoredProcedure

    cmd.Parameters.Add("@UserID", SqlDbType.Int).Value = Request.QueryString("UserID")

    con.Open()
    Using sdr As SqlDataReader = cmd.ExecuteReader()
      While sdr.Read()
        txtUsername.Text = sdr("Username")
      End While
    End Using

  End Using
End Using

In every instance the txtPassword Textbox is populated with the correct length password in the hidden type="password" format.

Nowhere am I binding the password nor is it requested in the stored procedure however it is stored in the database along with the username

If I change Textmode on the password textbox or do not output the username field then the password is no longer output.

Can someone explain this behaviour and point to the related spec?

DreamTeK
  • 32,537
  • 27
  • 112
  • 171
  • 6
    that might be the browser autocomplete feature – the_lotus Jun 23 '16 at 13:07
  • 1
    @the_lotus is right, just add this to the password tag `autocomplete="off"` to verify. It will no longer fills up – Vishnu Prasad V Jun 23 '16 at 13:08
  • 1
    Browsers let you save passwords. – Win Jun 23 '16 at 13:08
  • 1
    @the_lotus I think you are correct. For a moment I thought there was some kind of sorcery happening. Please can you post an answer to this effect? My confusion came as this is a user table for creating usernames and passwords and not a logn page but the form has remembered it from the login page. – DreamTeK Jun 23 '16 at 13:11

1 Answers1

1

This looks like your browser autocomplete feature. Like Vishnu Prasad said, try adding autocomplete="off" as a property to your control if you want to remove that feature.

Community
  • 1
  • 1
the_lotus
  • 12,668
  • 3
  • 36
  • 53