C#

string strQuery="";
strQuery = "select dashboardid from dashboardlogin where (loginname = '" + txtLoginName.Text + "') AND (loginpswd = '" + txtPassword.Text + "')";
SqlCommand cm = new SqlCommand(strQuery, conn);
int i = Convert.ToInt32(cm.ExecuteScalar());

coolestCoder wrote:

This is a simple solution but creating dynamic queries are prone to SQL Injection attacks. Use Stored procedures instead or use parameterized command object.

Nekshan wrote:

but it gives dashboardid of only loginname=hina.

Nekshan wrote:

what must i do to change my query for such result?

Nekshan wrote:

SqlCommand cm = new SqlCommand("select dashboardid from dashboardlogin where (loginname = 'hina') AND (loginpswd = 'shaikh')", conn);
int i = Convert.ToInt32(cm.ExecuteScalar());

i have this query working properly,but it gives dashboardid of only loginname=hina.
but i want dashboardid of that person who logs in the system(this code is on login form),whoever logs in the system,his dashboardid must be got in variable 'i'.
what must i do to change my query for such result?
thank you.
nekshan.

SqlCommand cm = new SqlCommand("SELECT dashboardid FROM dashboardlogin "+
"WHERE loginname = @loginname AND loginpwd = @password", conn);
cm.Parameters.Add("@loginname", theLoginName);
cm.Parameters.Add("@password", thePassword");
object rawId = cm.ExecuteScalar();
if (rawId == DBNull.Value)
{
    // The login wasn't found - handle this
}
else
{
    int id = (int)rawId;
    // Do stuff with the id
}

Nekshan wrote:

int s = Convert.ToString(cm.ExecuteScalar());

Nekshan wrote:

int s = Convert.ToString(cm.ExecuteScalar());
it gives error : Cannot implicitly convert type 'string' to 'int'.

<br />
SqlCommand cmd=new SqlCommand("select employeeid from employees where employeeid=1",conn);<br />
int s = Convert.ToInt32(cmd.ExecuteScalar());<br />
funEntrylogin(s, tb_id.Text, tb_pswd.Text, DateTime.Now, DateTime.Now);<br />

Nekshan wrote:

int s = Convert.ToString(cm.ExecuteScalar());

funEntrylogin(s, tb_id.Text, tb_pswd.Text, DateTime.Now, DateTime.Now);

jaimeaye wrote:

Maybe one could disassemble the ToolStripMenuItem and see what they are doing inside the ShowDropDown method.

using System.Diagnostics;

ProcessStartInfo PSIYourProc = new ProcessStartInfo();
StartLoader.UseShellExecute = false;
StartLoader.WorkingDirectory = @"C:\...";
StartLoader.FileName = @"C:\...\xxx.exe";
		
Process PYourProc = Process.Start(PSIYourProc);