Click here to Skip to main content
15,912,329 members
Please Sign up or sign in to vote.
1.00/5 (2 votes)
See more:
Here is my code what is the issue.


C#
private void button1_Click(object sender, EventArgs e)
       {
           SqlConnection con = new SqlConnection(@"Data Source=.;Database=master;Integrated Security=True");

           SqlDataAdapter sda = new SqlDataAdapter("SELECT * FROM Register WHERE usernmae='" + textBox1.Text + "' AND password='" + textBox2.Text + "'", con);
           /* in above line the program is selecting the whole data from table and the matching it with the user name and password provided by user. */
           con.Open();
           DataTable dt = new DataTable(); //this is creating a virtual table
           //sda.Fill(dt);
           con.Close();
           if (dt.Rows.Count >= 0)
           {
               /* I have made a new page called home page. If the user is successfully authenticated then the form will be moved to the next form */
               this.Hide();
               Dashboard  sn = new Dashboard();
               sn.Show();
               //new home().Show();
               //MessageBox.Show("done");
           }
           else
               MessageBox.Show("Not succesful Login");


What I have tried:

i want to login with the valid username and password if it is correct it should enter if not it should show an error instead of it it is loggin in.
Posted
Updated 9-Dec-19 8:43am
Comments
Garth J Lancaster 11-Sep-16 4:35am    
I think its the 'Integrated Security=True" in your connection string - its using Windows Authentication/credentials instead of 'database profile credentials/logon'

Your SQL sucks by the way - never a good idea to use concatenation to build a SQL statement, you leave yourself open to SQL injection attacks - use a parameterised SQL statement instead

There are several things wrong here:
1) Never hard code connection strings: they should be in configuration files, because they will normally be different for development and production: production will use a server based system that multiple machines connect to using an ID and password, developement if often done on a local installation using LOCALHOST and integrated security.
2) Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead.
3) Probably, your SQL database column, isn't called "usernmae", but "username"
4) Never store passwords in clear text - it is a major security risk. There is some information on how to do it here: Password Storage: How to do it.[^]
5) If all you are interested in is a number of rows, then use SELECT COUNT(*) and call ExecuteScalar to return a single value instead of wasting time and resources constructing datatables you will never use.
6) Think about your conditions:
C#
if (dt.Rows.Count >= 0)

If there are no matches in the DB, is that really a successful login?
 
Share this answer
 
You have many problems in this code.
-You have always successful login because of this:
if (dt.Rows.Count >= 0)

, it says that 0 is accepted, and since Count can not be negative ...
- Advice, put something in dt, it is better.
- Advice, never build an SQL query this way
"SELECT * FROM Register WHERE usernmae='" + textBox1.Text + "' AND password='" + textBox2.Text + "'"

when the values are user inputs, it open door to SQL Injection
SQL Injection[^]

[Update]
You should learn to use the debugger as soon as possible. Rather than guessing what your code is doing, It is time to see your code executing and ensuring that it does what you expect.

The debugger allow you to follow the execution line by line, inspect variables and you will see that there is a point where it stop doing what you expect.
Debugger - Wikipedia, the free encyclopedia[^]
Mastering Debugging in Visual Studio 2010 - A Beginner's Guide[^]
http://docs.oracle.com/javase/7/docs/technotes/tools/windows/jdb.html[^]
https://www.jetbrains.com/idea/help/debugging-your-first-java-application.html[^]

The debugger is here to show you what your code is doing and your task is to compare with what it should do.
When the code don't do what is expected, you are close to a bug.
 
Share this answer
 
v2
Comments
Member 12650438 16-Sep-16 1:31am    
should i keep value in dt?
Patrice T 16-Sep-16 2:47am    
There is no reason not to.
It is your design, you are the one who decide how thing go.
Member 12650438 16-Sep-16 3:23am    
what is the way to get out from the logging problem then can you change the the code which i have submitted.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900