Database

Re: w can User observe his private information

5-Sep-05 10:22

hi!
I have 2 form and 2 sql table :
the following fields are for 2 table :
table 1 :
id_user type[int],username type[nvarchar],password type[nvarchar]
table 2:
id_name type[int],name type[nvarchar],telephone type[decimal]
//-----
after the user enter his username and password , if it's correct , the second form show the private information .
Now I want to add,delete,save the User private information , in how ,every user enter his
username and password ,show his private info .
How can it possible?
//---------------------
in btnOK_Click Event ,for affirmative user and password is Here :
*************************

private void btnOK_Click(object sender, System.EventArgs e)<br />
{<br />
//------->Step :1<br />
if ((txtUserName.Text.Trim().Length == 0)|| (txtPassword.Text.Trim().Length == 0))<br />
{<br />
MessageBox.Show(Empty_MESSAGE,CAPTION_TITLE);<br />
txtPassword.Text="";<br />
txtUserName.Text="";<br />
return;<br />
}<br />
//------>Step :2<br />
string strFilter;<br />
strFilter = "SELECT UserName,Password FROM User_Name WHERE Password='" +txtPassword.Text + "' AND UserName='"+txtUserName.Text+"'";<br />
userAdapter=new SqlDataAdapter(strFilter,UserConnection);<br />
SqlCommandBuilder UserCmd=new SqlCommandBuilder(userAdapter);<br />
DataTable UserTable=new DataTable();<br />
userAdapter.Fill(UserTable);<br />
//------ Counting and Displaying<br />
UserView = new DataView(UserTable,DEFAULT_FILTER,DEFAULT_SORT,DataViewRowState.OriginalRows);<br />
//---->Step :3		<br />
if (UserView.Count == 0)<br />
{<br />
MessageBox.Show(NO_RECORDS_FOUND_MESSAGE,CAPTION_TITLE);<br />
txtPassword.Text="";<br />
txtUserName.Text="";<br />
}<br />
else<br />
{<br />
this.Hide();<br />
Private_Public_Form frm_pub_pri=new Private_Public_Form();<br />
frm_pub_pri.ShowDialog();<br />
}<br />
//************* Finish *******<br />
		<br />
}<br />
***********************************************<br />
thanks in advance!!!<br />
 <br />
<br />
mostafa hosseiny b.

Colin Angus Mackay5-Sep-05 20:53

My: Blog | Photos
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More

5-Sep-05 20:53

manije wrote:
strFilter = "SELECT UserName,Password FROM User_Name WHERE Password='" +txtPassword.Text + "' AND UserName='"+txtUserName.Text+"'";

This is NOT how I showed you to build this query[^]. This is now vulnerable to a SQL Injection Attack, and one that is very easily prevented. Please re-read the code I sent you before and if you don't understand it, I'll be happy to answer questions.

If you want to read more about how to prevent SQL Injection attacks. Something that is very important and double importance seing as this is verifying user names and passwords then you should read SQL Injection Attacks and Tips on How to Prevent Them[^]

Finally, just as an example of how easy your code is to attack I would suggest you type the following into the password box and trace through the code to see what it does:

' OR 1=1;--

Re:I want to know how a user can observe

mostafa_h6-Sep-05 1:57

Re:I want to know how a user can observe

6-Sep-05 1:57

Hi !
thanks for your guide !
but ,I don't understand ,OR,
I want to know , How can observe a user his private information , After everyone enter his username and password .
by the way , the code I wrote,can chech , is there user in the table or not ,in any case ,please help me !
thanks again!

mostafa hosseiny b.

Christian Graus6-Sep-05 11:51

Christian Graus

6-Sep-05 11:51

manije wrote:
but ,I don't understand ,OR,
I want to know ,

Colin has not really answered this, instead, he's pointed out that you've ignored the advice he gave you before.

manije wrote:
How can observe a user his private information

By you writing the code to display it. Once you know someone has logged in, you can ask the database for their information and display it any way you like.

Christian Graus - Microsoft MVP - C++

Connection Via DSN in VB.Net

MODI_RAHUL5-Sep-05 3:20

MODI_RAHUL

5-Sep-05 3:20

in vb.net when we create connection string
we want dsn name in the connection string i want connection via sqlserver

please suggest me what connection string i write

notify i don't want server name and database name in the connection string.

please help me
Sniff | :^)

Andy Brummer5-Sep-05 4:05

Andy Brummer

5-Sep-05 4:05

Since a DSN is part of ODBC configuration you need to use the ODBC data provider which will reduce your performance connecting to SQL server. And OLEDB option is to use a UDL file look under Storing Connection Strings on this page http://msdn.microsoft.com/library/default.asp?url=/library/en-us/dnbda/html/daag.asp[^].

Anothe option would be to encrypt the server and database name in a string and add the other information in at runtime.

I can imagine the sinking feeling one would have after ordering my book,
only to find a laughably ridiculous theory with demented logic once the book arrives - Mark McCutcheon

miah alom6-Sep-05 9:44

miah alom

6-Sep-05 9:44

If you create a DSN called abcd,

string myConnectionString ="DSN=abcd;UID=root;PWD=root";
OdbcConnection MyConn;
OdbcCommand MyCmd = new OdbcCommand();
MyConn = new OdbcConnection(myConnectionString);
MyConn.Open();
MyCmd.Connection = MyConn;
StringBuilder SQL = new StringBuilder();
SQL.Append("SELECT ");
SQL.Append("*");
SQL.Append("FROM ");
SQL.Append("Authors");
MyCmd.CommandText = SQL.ToString();
OdbcDataReader result = MyCmd.ExecuteReader(CommandBehavior.CloseConnection);
int nResultCount = 0;
while (result.Read())
{
++nResultCount;
}

Andy Brummer6-Sep-05 12:18

Andy Brummer

6-Sep-05 12:18

thanks.

I can imagine the sinking feeling one would have after ordering my book,
only to find a laughably ridiculous theory with demented logic once the book arrives - Mark McCutcheon

Please help me,,(MySql Front Installation)

Anonymous7-Sep-05 3:23

Anonymous

7-Sep-05 3:23

Jeeva Mary Varghese4-Sep-05 18:38

Jeeva Mary Varghese

4-Sep-05 18:38

Hi,
I am using MySqL-FRONT As my database.I installed MySql beta server,MySQl Font and MySql Odbc driver and I started the service of MySql .But when I am connecting the MySql -Front,the system seems to be hang.The system should have enough space(128 MB RAM).Please help me to overcome this situation.
Jeeva

User And Password with ...

mostafa_h4-Sep-05 8:58

Re: User And Password with ...

4-Sep-05 8:58

thank for your reply(Colin Angus Mackay )in advance!!
----
the type of password field = int
----
and this my code for check!?
----
private void btnOK_Click(object sender, System.EventArgs e)
{
//------->Step :1
if ((txtUserName.Text.Trim().Length == 0)|| (txtPassword.Text.Trim().Length == 0))
{

MessageBox.Show(Empty_MESSAGE,CAPTION_TITLE);
txtPassword.Text="";
txtUserName.Text="";
return;
}
//------>Step :2
string strFilter;
strFilter = "SELECT UserName,Password FROM User_Name WHERE Password='" +txtPassword.Text + "' AND UserName='"+txtUserName.Text+"'";
userAdapter=new SqlDataAdapter(strFilter,UserConnection);
SqlCommandBuilder UserCmd=new SqlCommandBuilder(userAdapter);
DataTable UserTable=new DataTable();
userAdapter.Fill(UserTable);
//------ Counting and Displaying
UserView = new DataView(UserTable,DEFAULT_FILTER,DEFAULT_SORT,DataViewRowState.OriginalRows);
//---->Step :3
if (UserView.Count == 0)
{
MessageBox.Show(NO_RECORDS_FOUND_MESSAGE,CAPTION_TITLE);
txtPassword.Text="";
txtUserName.Text="";
}
else
{
this.Hide();
//----displaying form
Private_Public_Form frm_pub_pri=new Private_Public_Form();
frm_pub_pri.ShowDialog();
}

//************* Finish ********/
}
//-----------
the difficult in this app. is , when password type=int
,system give an error , if we type in textbox of password non-numeral(character)

Colin Angus Mackay4-Sep-05 9:50

My: Blog | Photos
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More

4-Sep-05 9:50

First, 15 chars for a password is too small. Normally the passwords I use are 20+ chars and it irritates me when a website cannot accept such a long password. The longer the password, the more secure it is because it takes longer to crack. You should use something like an nvarchar(128) for a password.

Also, you should consider looking at encryption routines so that the password is stored in a secure fashion.

manije wrote:
By the Way if Password type=int [length=4] , what's the result the check ?

That doesn't make any sense.

To check the password on your current set up:

SqlConnection conn = new SqlConnection(myConnectionString);
SqlCommand cmd = new SqlCommand();
cmd.Connection = conn;
cmd.CommandText = "SELECT id_user FROM TheUserTable "+
    "WHERE username = @username AND password = @password";
cmd.Parameters.Add("@username", myUserName);
cmd.Parameters.Add("@password", myPassword);
conn.Open();
object result = cmd.ExecuteScalar();
if (result == null)
{
    // The user / password combination is not valid. Login fails
}
else
{
    // The user / password combination passes. This is a valid user.
    int userID = (int)result;
}

Does this help?

User And Password

mostafa_h4-Sep-05 2:57

4-Sep-05 2:57

hi all!
in c#.net:
in my application ,how can it check the user and password
is correct or not ?
for recieve and save user and password , we use a sql Table
thanks in advance!!
OMG | :OMG:

mostafa hosseiny b.

Re: User And Password

Colin Angus Mackay4-Sep-05 4:48

My: Blog | Photos
WDevs.com - Open Source Code Hosting, Blogs, FTP, Mail and More

4-Sep-05 4:48

We kind of need more information. We know nothing about this SQL Table you speak of. What is the structure of the table? Is the data encrypted? Did you look at the code that creates the user name and password and puts it in the table?

how do i access a column from database

ashima143-Sep-05 20:22

ashima14

3-Sep-05 20:22

hi all

i have made a table in SQL server2000..
now on the button click in my form using vb i want to check weather the value entered in the textbox is available in the column or not...it should check all the values in column of the database.....and display the appropriate msg

please....help me out....i am bugged up by this problem

ashima

ashima

Re: how do i access a column from database

Colin Angus Mackay3-Sep-05 21:31