How to Properly Close a SqlDataReader in C#?

Using SqlDataReader asynchronously prevents blocking the main thread, improving performance in web apps and large queries. Here’s how to do it properly.

Use await with ExecuteReaderAsync()

using (SqlConnection conn = new SqlConnection(connectionString))
{
    await conn.OpenAsync();
    using (SqlCommand cmd = new SqlCommand("SELECT * FROM Users", conn))
    using (SqlDataReader reader = await cmd.ExecuteReaderAsync()) 
    {
        while (await reader.ReadAsync()) 
        {
            Console.WriteLine(reader["Username"]);
        }
    } // ✅ Auto-closes reader
} // ✅ Auto-closes connection

Why use async?

A couple of reasons:

• Frees up the thread while waiting for the database.
• Improves scalability in ASP.NET Core and web apps.

⚡ Alternative: ConfigureAwait(false) for ASP.NET

Use ConfigureAwait(false) in library code to avoid deadlocks in UI frameworks like ASP.NET.

using (SqlConnection conn = new SqlConnection(connectionString))
{
    await conn.OpenAsync().ConfigureAwait(false);
    using (SqlCommand cmd = new SqlCommand("SELECT * FROM Users", conn))
    using (SqlDataReader reader = await cmd.ExecuteReaderAsync().ConfigureAwait(false)) 
    {
        while (await reader.ReadAsync().ConfigureAwait(false)) 
        {
            Console.WriteLine(reader["Username"]);
        }
    }
}

When working with URLs in C#, encoding is essential to ensure that special characters (like spaces, ?, &, and =) don’t break the URL structure. The recommended way to encode a string for a URL is by using Uri.EscapeDataString(), which converts unsafe characters into their percent-encoded equivalents.

string rawText = "hello world!";
string encodedText = Uri.EscapeDataString(rawText);

Console.WriteLine(encodedText); // Output: hello%20world%21

This method encodes spaces as %20, making it ideal for query parameters.

For ASP.NET applications, you can also use HttpUtility.UrlEncode() (from System.Web), which encodes spaces as +:

using System.Web;

string encodedText = HttpUtility.UrlEncode("hello world!");
Console.WriteLine(encodedText); // Output: hello+world%21

For .NET Core and later, Uri.EscapeDataString() is the preferred choice.

Storing passwords as plain text is dangerous. Instead, you should hash them using a strong, slow hashing algorithm like BCrypt, which includes built-in salting and resistance to brute-force attacks.

Step 1: Install BCrypt NuGet Package

Before using BCrypt, install the BCrypt.Net-Next package:

dotnet add package BCrypt.Net-Next

or via NuGet Package Manager:

Install-Package BCrypt.Net-Next

Step 2: Hash a Password

Use BCrypt.HashPassword() to securely hash a password before storing it:

using BCrypt.Net;

string password = "mySecurePassword123";
string hashedPassword = BCrypt.HashPassword(password);

Console.WriteLine(hashedPassword); // Output: $2a$12$...

Step 3: Verify a Password

To check a user's login attempt, use BCrypt.Verify():

bool isMatch = BCrypt.Verify("mySecurePassword123", hashedPassword);
Console.WriteLine(isMatch); // Output: True

Ensuring proper hashing should be at the top of your list when it comes to building authentication systems.