Sql data reader in classes
<p>Hi
On several pages of our website, I want to check if the currently logged in user has accepted our terms and conditions in the past. This boolean value is stored in the application database. Rather than creating a sql data reader afresh on each relevant page, I thought I could put it in a class and then assign the true/false to a variable. This is what I have so far and it does exactly what I want it to:</p>

<pre><code>Public Shared ReadOnly Property termsCompleted As String
    Get
        Dim selectTerms As String = "SELECT Terms FROM tblPersonal WHERE Ref=@Ref"

        Dim dbconn As String = ConfigurationManager.ConnectionStrings("ApplicationServices").ConnectionString
        Using myConnection As New SqlConnection(dbconn)
            myConnection.Open()

            Dim cmdTerms As New SqlCommand(selectTerms, myConnection)
            cmdTerms.Parameters.AddWithValue("@Ref", myUser.ToString())

            Dim readerTerms As SqlDataReader = cmdTerms.ExecuteReader()
            readerTerms.Read()

            termsCompleted = readerTerms.Item(0)

            readerTerms.Close()
            myConnection.Close()

        End Using

    End Get
End Property
</code></pre>

<p>I am them using the following on each page that is relevant to deny access and redirect (in the page_load):</p>

<pre><code>If Variables.termsCompleted = False Then
        Response.Redirect("Terms.aspx")
    End If
</code></pre>

<p>While this works ok, i'm interested in how secure it is, and is there a better way to do this? </p>

<p>Thanks</p>
