Login form with multiple users in VB.net using MS SQL Server

when you select from database you get values in columns, those values are read by your datareader. to read a value you don't check if sql, just add another column which indicates if a user has admin privs or not, like a boolean but as varchar True/False "isAdmin" and check it like:

if dr.hasrows then
  if dr("isAdmin").tostring = "True" then
    'user is admin'''
  else
    'user is not admin'''
  end if
else
  msgbox("Access Denied")
end if

hope it's what you're looking for

btw

WHERE Username = 'Gabby'" & "WHERE Password = 'Nanamin' "

will give you an error cause GabbyWHERE has no space between

i would put it like this:

...WHERE Username = 'Gabby' AND Password = 'Nanamin'"

The answer posted by @Devcon is what you need and should be accepted. I am just filling in a few details on how to accomplish this.

Notice that all database objects are enclosed by Using...End Using blocks. This ensures that your database objects are closed and disposed even if there is an error.

Connection strings are passed directly to the constructor of the Connection and sql statements and connections are passed directly to the constructor of the Command.

Sql statements are parameterized. Never concatenate strings to build sql statements. It opens your database to sql injection.

First, you need to add a column to the RegisterList table to indicate if a user is an administrator. We made this a Boolean column which is a bit datatype in Sql Server. You will be able to add values of True or False. You would only do this once. It would not normally be part of your program.

Private Sub AddColumn()
    Using cn As New SqlConnection("Data Source=NECRONOMICON\SQLEXPRESS01;Initial Catalog=Register;Integrated Security=True;")
        Using cmd As New SqlCommand("Alter Table RegisterList Add IsAdministrator bit;", cn)
            cn.Open()
            cmd.ExecuteNonQuery()
        End Using
    End Using
End Sub

Next, update your users records to reflect their administrative status. This would normally be done as part of creating the user record with the original Insert command and not in an Update.

Private Sub AddAdminStatus()
    Using cn As New SqlConnection("Data Source=NECRONOMICON\SQLEXPRESS01;Initial Catalog=Register;Integrated Security=True;")
        Using cmd As New SqlCommand("Update RegisterList Set IsAdministrator = @IsAdmin Where Username = @Name")
            cmd.Parameters.Add("@IsAdmin", SqlDbType.Bit)
            cmd.Parameters.Add("@Name", SqlDbType.VarChar, 100)
            cmd.Parameters("@IsAdmin").Value = False
            cmd.Parameters("@Name").Value = "Joshua"
            cmd.ExecuteNonQuery()
            cmd.Parameters("@Name").Value = "Gabby"
            cmd.Parameters("@IsAdmin").Value = True
            cmd.ExecuteNonQuery()
        End Using
    End Using
End Sub

Finally, we can validate the input. The Select command only askes for the value of the IsAdministrator column. If there is no matching record or no value in this column then Nothing is returned.

Private Sub BtnLogin_Click(sender As Object, e As EventArgs) Handles btnLogin.Click
    If txtUsername.Text = "" OrElse txtPassword.Text = "" Then
        MessageBox.Show("Please fill in all fields.", "Login Error", MessageBoxButtons.OK, MessageBoxIcon.Error)
        Return
    End If
    Dim RetVal As Object
    Using conn As New SqlConnection("Data Source=NECRONOMICON\SQLEXPRESS01;Initial Catalog=Register;Integrated Security=True;")
        Using cmd As New SqlCommand("SELECT IsAdministrator FROM RegisterList WHERE Username= @UserName AND Password= @Password;", conn)
            cmd.Parameters.Add("@UserName", SqlDbType.VarChar, 100).Value = txtUsername.Text
            cmd.Parameters.Add("@Password", SqlDbType.VarChar, 100).Value = txtPassword.Text
            conn.Open()
            RetVal = cmd.ExecuteScalar 'Returns a single value, the first column or the first row of the result set
        End Using
    End Using
    If RetVal Is Nothing Then
        MessageBox.Show("Sorry, your login is not valid or your have no status assigned")
    ElseIf CBool(RetVal) Then
        MessageBox.Show("Welcome")
        Admin_control_interface.Show()
        Hide()
    Else
        Loaner_Status10.Show()
        Hide()
    End If
End Sub

Lastly, passwords should NEVER be stored as plain text. This is the fault of your instructor. Before teaching you logins the process of salting and hashing passwords should be taught.