MobileShop

Technology Stack

Core technologies powering the application

🪟

Windows Forms

Classic desktop UI framework

⚡

.NET 8

Target: net8.0-windows

🗄️

SQL Server Express

Local .\SQLEXPRESS instance

🔌

System.Data.SqlClient

ADO.NET data access

🎨

GDI+ Imaging

Product image rendering

🔐

Session Management

Static Session holder class

Project Files

Every source file and what it does

📄 Program.cs entry

Application entry point. Launches the main form.

Application.Run(new Form1())

📄 Session.cs utility

Static session holder shared across forms.

UserId (int)
UserName (string)
Role (string)

🖼️ Form1.cs form

Main UI — product listing, search, sort, cart grid.

LoadProducts(search, sort)
Add_Click → Cart insert/update
RefreshCartSummary()
RefreshCartGrid()

🔐 LoginForm.cs form

Email + password authentication.

Validates against Users table
Populates Session on success
Links to Register / Forgot

📝 RegisterForm.cs form

New user registration with role 'Customer'.

Name, Email, Phone, Password
INSERT INTO Users

🔑 ForgotPasswordForm.cs form

Multi-step password recovery flow.

Verify email → Verify phone
Update password

📱 ProductDetailsForm.cs form

Single product detail view with specs.

Fetches by Id
Add to cart (mirrors Form1)

💳 CheckoutForm.cs form

Order placement — COD or bKash online.

Creates Order record
Writes OrderItems
Decrements stock
Clears cart

⚙️ AdminForm.cs form

Admin dashboard for products & orders.

CRUD products
View orders
Image upload support

✅ OrderSuccessForm.cs form

Confirmation screen after placing an order.

📋 *.Designer.cs generated

Auto-generated UI control definitions for each form.

User Flows

Step-by-step journeys through the application

🔐 Login Flow

Enter email + password

SELECT * FROM Users WHERE Email=@email AND Password=@pass

Set Session.UserId / UserName / Role

Redirect to Form1 (main screen)

🛒 Add to Cart

Click "Add" on a product

Check login (Session.UserId)

SELECT Quantity FROM Cart WHERE UserId=@uid AND ProductId=@pid

If exists → UPDATE Quantity+1 · Else → INSERT

Refresh cart summary + grid

💳 Checkout Flow

Review cart + enter address

Select COD or bKash

INSERT INTO Orders (OUTPUT INSERTED.Id)

For each cart item → INSERT OrderItems

UPDATE Products SET Stock = Stock - qty

DELETE FROM Cart WHERE UserId=@uid

Show OrderSuccessForm

⚙️ Admin Product CRUD

Open AdminForm (Role = 'Admin')

Load products + orders

INSERT / UPDATE / DELETE Products

Browse image files locally

Parse discount strings (% suffix)

SQL Queries by File

Every query extracted from source code, grouped by file

-- Load products with optional search/sort SELECT Id, Name, Price, Discount, ImagePath FROM Products [WHERE Name LIKE @s] [ORDER BY ...]

SELECT Quantity FROM Cart WHERE UserId = @uid AND ProductId = @pid

UPDATE Cart SET Quantity = Quantity + 1 WHERE UserId = @uid AND ProductId = @pid

INSERT INTO Cart (UserId, ProductId, Quantity) VALUES (@uid, @pid, 1)

-- Cart total with discount applied SELECT SUM(p.Price * (1 - ISNULL(p.Discount,0)/100.0) * c.Quantity) FROM Cart c JOIN Products p ON c.ProductId = p.Id WHERE c.UserId = @uid

SELECT SUM(Quantity) FROM Cart WHERE UserId = @uid

SELECT p.Id AS ProductId, p.Name, c.Quantity, (p.Price * (1 - ISNULL(p.Discount,0)/100.0)) AS Price, (...) AS Total FROM Cart c JOIN Products p ON c.ProductId = p.Id WHERE c.UserId = @uid

INSERT INTO Users (Name, Email, Phone, Password, Role) VALUES (@name, @email, @phone, @pass, 'Customer')

-- Step 1: verify email exists SELECT * FROM Users WHERE Email = @email

-- Step 2: verify phone matches SELECT * FROM Users WHERE Email = @email AND Phone = @phone

-- Step 3: update password UPDATE Users SET Password = @pass WHERE Email = @email

SELECT * FROM Products WHERE Id = @id

SELECT Quantity FROM Cart WHERE UserId = @uid AND ProductId = @pid

INSERT INTO Cart (UserId, ProductId, Quantity) VALUES (@uid, @pid, 1)

UPDATE Cart SET Quantity = Quantity + 1 WHERE UserId = @uid AND ProductId = @pid

SELECT Name, Phone FROM Users WHERE Id = @id

SELECT p.Id, p.Name, c.Quantity, (p.Price * (1 - ISNULL(p.Discount,0)/100.0)) AS Price, (...) AS Total FROM Cart c JOIN Products p ON c.ProductId = p.Id WHERE c.UserId = @uid

-- ⚠️ Uses string concatenation (security risk) INSERT INTO Orders (UserId, CustomerName, Phone, Address, TotalAmount, PaymentMethod, TransactionId) OUTPUT INSERTED.Id VALUES (...)

SELECT ProductId, Quantity FROM Cart WHERE UserId = {Session.UserId}

INSERT INTO OrderItems (OrderId, ProductId, Quantity, Price) VALUES (orderId, pid, qty, (SELECT Price * (1 - ISNULL(Discount, 0) / 100.0) FROM Products WHERE Id = pid))

UPDATE Products SET Stock = Stock - qty WHERE Id = pid

DELETE FROM Cart WHERE UserId = {Session.UserId}

SELECT * FROM Products

SELECT * FROM Orders

INSERT INTO Products (Name, Brand, Model, Price, Discount, Stock, ImagePath, Specifications) VALUES (@...)

UPDATE Products SET ... WHERE Id = @id

DELETE FROM Products WHERE Id = @id

Security & Maintenance Notes

Issues identified during code review

🔴 Plaintext Passwords

Passwords are stored and compared as raw strings in the Users table. Use bcrypt/Argon2 with per-user salt.

🔴 SQL Injection in CheckoutForm

Queries orderQ, cartQ, itemQ, stockQ, delQ are built via string concatenation. Replace with SqlParameter.

🟡 Missing Input Validation

Discount parsing supports '%' suffix but other inputs (email format, phone length) aren't consistently validated.

🟡 Connection String Hardcoded

The connection string is duplicated across files. Move to appsettings.json or ConfigurationManager.

🔵 Good: using/Dispose Pattern

Most code correctly uses using blocks for SqlConnection and SqlCommand.

🔵 Good: Parameterized Queries (mostly)

Form1, LoginForm, RegisterForm, and AdminForm use parameters correctly — only CheckoutForm needs fixing.