ASP.NET

ASPnoob wrote:

I had done some search on String.Format and some of the sites I visited said that the 1st value within the parentheses serves as the place holder for the 2nd value.

ASPnoob wrote:

strSQL = String.Format("SELECT UserName FROM MembersInfotbl WHERE (email='{0}');", txtUserName.Text)

Function DBAuthenticate(ByVal strUsername As String, ByVal strPassword As String) As Integer
       Dim bResult As Boolean = False
       Dim objConn As New OleDbConnection(ConfigurationSettings.AppSettings("myDB"))
       Dim strSQL As String
       Dim strGoodPassword As String
       Dim objCommand As New OleDbCommand

       objCommand.Connection = objConn
       strSQL = String.Format("SELECT p_w FROM myDB WHERE (email='{0}');", txtUserName.text)
       objCommand.CommandText = strSQL
       objCommand.CommandType = CommandType.Text

       objConn.Open()
       strGoodPassword = CType(objCommand.ExecuteScalar, String)
       objConn.Close()

       If Not strGoodPassword Is Nothing Then
           If strGoodPassword = strPassword Then
               bResult = True
           Else
               lblMessage.Text = "Invalid Login!"
               lblMessage.Text &= "  If you are not a member please click the above link to register."
           End If
       Else
           lblMessage.Text = "Invalid Login!"
           lblMessage.Text &= "  If you are not a member please click the above link to register."
       End If

       Return bResult
   End Function