Check Mysql DB for username and password C#

Question

Been having problems with this for a couple of days. I'm working on a login screen with a simple username and password, and having everything store in a database. Pretty much I need to to check to see if the username and password match up and also see if if there account is activated(either a 0 or 1). I have been having problems with this and can't seem to get it to work correctly. Any help is appreciated.

DB Mysql

    private void loginButton_Click(object sender, EventArgs e)
        {
            AdamPanel blarg = new AdminPanel();
            string pass, user;
            string password = "";
            string username = "";

            user = usernameBox.Text;
            pass = passwordBox.Text;           
            DataSet bb = new DataSet();

            string connectionString = "datasource=stuff;database=users";
            MySqlConnection mysql = new MySqlConnection(connectionString);
            MySqlDataAdapter adapter = new MySqlDataAdapter();

            adapter.SelectCommand = new MySqlCommand("SELECT * FROM RegularUsers WHERE Username = '" + user + "' AND Password = '" + pass + "'", mysql);
            adapter.Fill(bb);

            if(bb.HasRows)
                blarg.Show();
            return 0;





        }

    }
}

still not working any ideas?

Not sure what your question is exactly? Where are you stuck? — Pekka
– Pekka, Commented Feb 28, 2011 at 1:14
Are you having issues connecting to the database or with the actual query? An example of the code you're using would help us help you :) — Dave L
– Dave L, Commented Feb 28, 2011 at 1:17
I don't really even know where to start. I have it connected but I don't know where to go from there. — seandidk
– seandidk, Commented Feb 28, 2011 at 1:29
you're using paSS and usER instead of this.username and this.password. paSS and usER were never populated with the user's values. — Highstead
– Highstead, Commented Feb 28, 2011 at 21:07

Highstead · Accepted Answer · 2011-02-28 20:59:48Z

2

First of all PLEASE hash and salt your passwords. Make sure your username/pw arn't sql injection vulnerable since you're not using a language with parameterized queries... prolly best using stored procs as i believe MySql has them now.

However, in spite of this... i think this is what you're looking for.

public int Load()
    {
        string connectionString = "datasource=STUFF YOU SHOULDNT SEEdatabase=users";
        MySqlConnection mysql = new MySqlConnection(connectionString);
        MySqlDataAdapter adapter = new MySqlDataAdapter();

        mysql.SelectCommand = new MySqlCommand("SELECT * FROM [RegularUsers] WHERE Username = '" + this.username + "' AND Pass = '" + this.password + "'", conn);
        mysql.Fill(dataset);


        if (dataset.HasRows)
            return 1;
        return 0;
    }

answered Feb 28, 2011 at 20:59

Highstead

2,4413 gold badges28 silver badges31 bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Matt Hudson · Accepted Answer · 2011-02-28 21:55:59Z

1

  public bool ValidateLogin(string username, string password)
  {

    MySqlConnection conn = new MySqlConnection("[YOURCONNECTIONSTRING]");
    MySqlDataAdapter adapter = new MySqlDataAdapter();
    adapter.SelectCommand = new MySqlCommand("SELECT * FROM [YOURUSERTABLE] WHERE Username = ? AND Pass = ?", conn);

    adapter.SelectCommand.Parameters.Add("@Username", username);
    adapter.SelectCommand.Parameters.Add("@Password", password);

    adapter.Fill(dataset);


    If (dataset.HasRows)
    {
      // User is logged in maybe do FormsAuthentication.SetAuthcookie(username);
        return true;
    } else {
      // Authentication failed
      return false;
    }

  }

edited Feb 28, 2011 at 21:55

answered Feb 28, 2011 at 3:10

Matt Hudson

7,3587 gold badges53 silver badges68 bronze badges

6 Comments

seandidk Over a year ago

Perfect, now my question is instead of putting it into a data set just compare and then return a 1 or a 0.

Paul Over a year ago

You might want to think about parameterizing the query, or minimally sanitizing the inputs in some fashion so you don't get sql inject attacks here. . .

Matt Hudson Over a year ago

Paul is absolutely correct, so I added some parameters. Don't forget to change the [YOURCONNECTIONSTRING] and [YOURUSERTABLE] parts to your code.

seandidk Over a year ago

Yeah I am going to hash and salt my passwords, I'm just trying to get db connecting and working.

seandidk Over a year ago

Also is there a speefic library that I need to use to use "dataset"? or declare one?

|

Marco · Accepted Answer · 2011-04-01 14:18:14Z

First of all you must include using MySql.Data.MySqlClient.
Use these functions:

public MySqlConnection NewConnection()
{
    string cstr = String.Format(
        "SERVER={0};PORT={1};DATABASE={2};UID={3};PWD={4}",
        sett.DBHost, sett.DBPort, sett.DBDatabase,
        HotelDB.user, HotelDB.password);
    MySqlConnection conn = new MySqlConnection(cstr);
    try { conn.Open(); }
    catch (Exception ex)
    {
        conn = null;
    }
    return conn;
}


private MySqlCommand NewCommand(MySqlConnection conn, string cmd, params object[] parameters)
{
    if (conn==null) return null;
    MySqlCommand command;
    try
    {
        command = new MySqlCommand(cmd, conn);
        if (parameters != null)
        {
            int index = 0;
            while (index < parameters.Length)
            {
                command.Parameters.Add(
                    new MySqlParameter((string)parameters[index], parameters[index + 1]));
                index += 2;
            }
        }
    }
    catch { command = null; }
    return command;
}

private string MD5(string Value)
{
        System.Security.Cryptography.MD5CryptoServiceProvider x = new System.Security.Cryptography.MD5CryptoServiceProvider();
        byte[] data = System.Text.Encoding.ASCII.GetBytes(Value);
        data = x.ComputeHash(data);
        string ret = "";
        for (int i=0; i < data.Length; i++)
                ret += data[i].ToString("x2").ToLower();
        return ret;
}

Then you can do:

MySqlConnection conn = NewConnection(.....);
MySqlCommand cmd = NewCommand(conn,"SELECT userid,useractive FROM table WHERE username=@user AND MD5(password)=@pwd","user",username,"pwd",MD5(pwd));
MySqlDataReader rd = cmd.ExecuteReader();

Where username and pwd are the ones typed from user. If rd is empty user/pwd are wrong; otherwise you can read the fields you need.

user20416 · Accepted Answer · 2016-03-29 18:35:53Z

1

I changed the some variables and make it simple as possible, instead declaring a variable for textbox, i direct it to the adapter:

private void button Click
{
    MySqlConnection mcon = new MySqlConnection("Yourconnection");
    MySqlDataAdapter adapter;
    DataTable table = new DataTable();

    adapter = new MySqlDataAdapter("Select * From database.table where Username = '" + textbox1.Text + "' and password = '" + textbox2.Text +  "'", mcon);
    adapter.Fill(table);
    if (table.Rows.Count <= 0)
    {
        //message something
    }
    else
    {
        //show main form
    }
}

edited Mar 29, 2016 at 18:35

user20416

15.5k9 gold badges76 silver badges149 bronze badges

answered Mar 29, 2016 at 15:54

Angelo Santos

112 bronze badges

1 Comment

Fizz Over a year ago

You may want to add some details as to what you changed and why.

Collectives™ on Stack Overflow

Check Mysql DB for username and password C#

4 Answers 4

Comments

6 Comments

Comments

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

4 Answers 4

Comments

6 Comments

Comments

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related