form validation using c# and sql commands

Question

i am trying to make a windows form to log into another one, i am using a database with users and passwords the code is as follows:

private void button1_Click(object sender, EventArgs e)
{
    SqlConnection conn = new SqlConnection("Data Source=mmtsql.XXX.XXXX.XX.XX;Initial Catalog=mmtXX-XXX;User ID=mmtXX-XXX;Password=mmtXX-XXX");
    conn.Open();
    SqlCommand mycommand = new SqlCommand("SELECT User, Password FROM UsersData WHERE User = '" + textBox1.Text + "' and Password = '" + textBox2.Text + "'", conn);
    SqlDataReader reader = mycommand.ExecuteReader();
    if(reader != null) 
    {
        if(reader.Read())
        {
            Form1 formload = new Form1();
            formload.Show();
        }
        else
        {
            label3.Text = "Invalid Username or Password !";
        }
    }
    else
    {
        label3.Text = "Invalid Username or Password !";
    }

the problem that a getting is that no matter what i insert into the textboxes, right or wrong i am getting:

Invalid Username or Password !

is there anyway to fix my code? regards;

use breakpoints to see what query is being executed. run that query in SQL server and see whether you are getting any results. — Shyju
– Shyju, Commented Mar 10, 2013 at 20:13
Also try to remove password from where clause and see what you get — DevelopmentIsMyPassion
– DevelopmentIsMyPassion, Commented Mar 10, 2013 at 20:20

Mike C. · Accepted Answer · 2013-03-10 21:07:19Z

1

I would do it this way, keeping to the method you are using:

private void button1_Click(object sender, EventArgs e)
{
    SqlConnection conn = new SqlConnection(conn_str);
    conn.Open();
    string sql = "SELECT User, Password 
        FROM UsersData WHERE User=@user and Password=@password"
    SqlCommand mycommand = new SqlCommand(sql, conn);
    //parameterize your query!
    mycommand.Parameters.AddWithValue("user", txtuser.text);
    mycommand.Parameters.AddWithValuye("password", txtpassword.password);

    SqlDataReader reader = mycommand.ExecuteReader();
    if(reader == null)
    {
        label3.Text = "Database query failed!";
    }
    else if(reader.HasRows)
    {
        Form1 formload = new Form1();
        formload.Show();
    }
    else
    {
        label3.Text = "Invalid Username or Password !";
    }

edited Mar 10, 2013 at 21:07

answered Mar 10, 2013 at 20:37

Mike C.

3,1442 gold badges24 silver badges18 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

user2040978 Over a year ago

thank you for the suggesstion, i have done what you asked me for and i am getting "invalid username or password" exactly the same as before

Mike C. Over a year ago

AT this point I'd be using Sql Server Mgmt Studio to connect and verify that the query even returns results.

DevelopmentIsMyPassion · Accepted Answer · 2013-03-10 20:42:35Z

Use parameterized queries as they will help you against sql injection as mentioned by SLaks. Change your code to below

using (SqlCommand command = new SqlCommand("SELECT User, Password 
    FROM UsersData WHERE User=@user and Password=@password", connection))
    {
    //
    // Add new SqlParameter to the command.
    //
    command.Parameters.Add(new SqlParameter("user ", textbox1.text));
            command.Parameters.Add(new SqlParameter("password", textbox2.text));

    SqlDataReader reader = command.ExecuteReader();
            if (reader == null)

    {
      Form1 formload = new Form1();
              formload.Show();    
    }
            else
            {
              label3.Text = "Invalid Username or Password !";    
            }
   }

Collectives™ on Stack Overflow

form validation using c# and sql commands

2 Answers 2

2 Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related