Click here to Skip to main content
15,885,890 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
I am designing a web application in c# Asp.net and after I debug it keeps telling me
An exception of type 'System.data.sqlclient.sqlexception occurred in system.data.dll but was not handled in user code
Additional information: An expression of non-boolean type specified in a context where a condition is expected, near 'number'.





This is my code:


using system;
using system.collections.generic;
using system.ling;
using system.web;
using system.web.UI;
Using system.web.UI.Webcontrols;
using system.Data.SqlClient;
using system.Data.configuration;

namespace SCMS_WEB_APP
{
public partial class login : system.web.ui.page

protected void page_load

{
If(IsPostBack)
{
Sqlconnection Conn = new sqlconnection(configuration manager.connectionstrings["studentsregconnectionstring"]. connection string);
Conn.open();
string check user = "select count(*) from studentsreg where registration number ='"+reg number.Text+"'";


Sqlcommand com = new sqlcommand (check user, conn);

int temp = convert.ToInt32(com execute Scalar());

If(temp==1)
{
Response.Write("invalid");
}

Conn.close();

}
}

Protected void button2.click
{
try
{
sqlconnection Conn = new sqlconnection (configuration manager.connectionstrings["studentsregvinnectionstrings"]. connection strings
Conn.open();
String insertQuery = insert into studentsreg (username, password)values(@username,@pasword)";
Sqlcommand com = new sqlcommand (insertQuery, conn);

com.parameters.addwithvalue("@username",rextbox1.text);
com.parameters.addwithvalue(@password",textbox2.text);

com.ExecuteNonQuery();
Response.Refirect("admin.aspx")
Conn.close();
}
catch(Exception ex)
{
Response.Write("Error:+"ex.ToString());
}

)
}
}

What I have tried:

I've tried fixing the issue but it's not working.
Please help
Posted
Updated 19-Sep-21 19:47pm
Comments

1 solution

WOW! You have a metric sh*t-ton of problems:

C# is a case-sensitive language, and nearly every line of code has case problems.

Spaces in variable names are not allowed ("check user" should be "checkUser").

Local variables should be in camelCase.

Spaces in object names are not allowed.
("configuration manager" should be "ConfigurationManager")

Your "If" should be "if".

You have "Using" when it should be "using".

Namespaces always have the first character capitalized ("System", not "system").

You're using string concatenation to build an SQL query. You should be using parameterized queries instead.

Column names in SQL should NEVER have spaces in them "registration number".

ExecuteScaler should be one word, not two, and it returns an object you can just cast to an int. No need to use Convert.

You have an extra closing parenthesis that should be removed near the bottom of the code.

Your logic in the Page_Load event handler is wrong. If the query returns 1, that's an error?

Various spelling errors all over the place.

Mismatched parameter names in the SQL and parameters you did use.

Storing user passwords in clear text in the database is a HUGE security risk. Store salted and hashed password data instead.

You have no validation of user input at all. This can lead to crashes and, in you case, destruction of the database because you used string concatenation to build an SQL query statement. Google for "Sql injection attack" for more information on this.

Event handler method headers are not only wrong, the parameter lists they need are completely missing.

... I'm too tired for more of this ...

This is cleaned up, but it still needs work on your part to fix things up to the point where it will even have a change of compiling. And this doesn't include what I suspect is your ASPX page code being completely screwed up too.
C#
using System;
using System.Collections.Generic;
using System.Ling;
using System.Web;
using System.Web.UI;
using System.Web.UI.Webcontrols;
using System.Data.SqlClient;
using System.Data.Configuration;

namespace SCMS_WEB_APP
{
    public partial class login : System.Web.Ui.Page

    protected void Page_Load(...stuff is missing here...)
    {
        if (IsPostBack)
        {
            Sqlconnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["studentsregconnectionstring"].ConnectionString);
            conn.Open();

            // You hsould be using a parameterized query here, like below
            string checkUserQuery = "SELECT COUINT(*) FROM studentsreg WHERE RegistrationNumber ='"+reg number.Text+"'";  <-- BAD!!

            Sqlcommand comm = new SqlCommand(checkUserQuery, conn);

            int temp = (int)comm.ExecuteScalar();

            if (temp==1)
            {
                Response.Write("invalid");
            }
            
            conn.close();
        }
    }

    protected void Button2.Click(...stuff is missing here...)
    {
        try
        {
            SqlConnection conn = new sqlconnection (configuration manager.connectionstrings["studentsregvinnectionstrings"]. connection strings
            conn.open();

            string insertQuery = "INSERT INTO studentsreg (username, password) VALUES (@username, @password)";
            Sqlcommand comm = new SqlCommand(insertQuery, conn);

            comm.Parameters.AddWithValue("@username", textbox1.text);
            comm.Parameters.AddWithValue("@password", textbox2.text);

            comm.ExecuteNonQuery();
            Response.Redirect("admin.aspx")
            conn.Close();
        }
        catch (Exception ex)
        {
            Response.Write("Error:" + ex.ToString());
        }
    }
}
 
Share this answer
 
v2

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900