Click here to Skip to main content
15,885,944 members
Please Sign up or sign in to vote.
1.00/5 (2 votes)
See more:
C#
Line 37:         dt = ds.Tables("Tabel")
Line 38:         If dt.Rows.Count > 0 Then
Line 39:             Response.Redirect


What I have tried:

Protected Sub ButLog_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles ButLog.Click
        Dim con As New SqlConnection
        Dim cmd As New SqlCommand("log1")
        Dim ADD As New SqlDataAdapter
        cmd.CommandType = CommandType.StoredProcedure
        Dim ds As New DataSet
        Dim dt As New DataTable
        con.ConnectionString = "Server=.;Database=log;User Id=sa; Password=123;"
        cmd.Connection = con
        ADD.SelectCommand = cmd

        ' Dim cmd2 As SqlCommand = New SqlCommand("SELECT * FROM [pationt] WHERE [pationt_usermane] = '" & txtUser.Text & "' AND [pationt_pass] = '" & txtpass.Text & "'", con)
        'Dim dr As SqlDataReader = cmd2.ExecuteReader
        ' the following variable is hold true if user is found, and false if user is not found
        Dim userFound As Boolean = False
        ' the following variables will hold the user first and last name if found.
        cmd.Parameters.Add("@Username", SqlDbType.VarChar)
        cmd.Parameters("@Username").Value = TxtUser.Text
        cmd.Parameters.Add("@Password1", SqlDbType.VarChar)
        cmd.Parameters("@Password1").Value = TxtPass.Text
        con.Open()
        'ADD.Fill(ds, "Tabel")
        con.Close()
        'dt = ds.Tables("Tabel")

        If > 0 Then
            Response.Redirect("welcome.aspx")
        Else
            MsgBox("Sorry, username or password not found", MsgBoxStyle.OkOnly, "Invalid Login")
            ' ClientScript.RegisterStartupScript(Page.[GetType](), "validation", "<script language=")
        End If
    End Sub
Posted
Updated 22-Mar-16 4:14am
v2
Comments
Malak Hudaib 22-Mar-16 10:09am    
when i log in with username and password not saved in ,
this error display ...(Object reference not set to an instance of an object.)
plz help me
Thanks7872 22-Mar-16 10:11am    
dt = ds.Tables("Tabel")
I doubt,ds is null here. Before this line,make sure you are getting proper data inside ds. Before accessing tables inside ds,you should check it for null and empty.

1 solution

You've commented out the line that fills the DataSet, so it doesn't contain a table called Tabel.

But you could have figured that out for yourself if you'd debugged your code. :doh:

Also, I'm guessing from the Response.Redirect line that this is an ASP.NET application; in that case, MsgBox will not work. At best, it will throw an exception indicating that the current process is not interactive. At worst, it will display a message on the server, where nobody will ever see it, and then hang waiting for someone to press the "OK" button.

And finally, your application should never connect to the database using the sa account. That is a super-user which could be used to totally destroy your network. Instead, you should be using an account which has only the permissions needed to run your application.

And if that's your real sa passwords, change it immediately to something secure. Don't pick important passwords from a "list of the least secure passwords ever" article!

Oh, and also, the commented-out query line is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

And you appear to be storing passwords in plain text, which is a terrible idea. You should only ever store a salted hash of the password, using a unique salt per record.

Secure Password Authentication Explained Simply[^]
Salted Password Hashing - Doing it Right[^]
 
Share this answer
 
v2

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900