Click here to Skip to main content
15,890,506 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
C#
SqlConnection con = new SqlConnection("Data Source=USER-PC;Initial Catalog=Test;Integrated Security=True");
SqlDataAdapter sda = new SqlDataAdapter("select role from login where username='" + textBox1.Text + "' and password='" + textBox2.Text + "' ",con);
DataTable dt = new DataTable();
sda.Fill(dt);
if (dt.Rows.Count==1)
{
    this.Hide();
    MDIParent1 kk = new MDIParent1();
    kk.Show();
Posted
Comments
Richard Deeming 1-Dec-15 8:40am    
Also, you're storing passwords in plain text. That's an extremely bad idea. You should only ever store a salted hash of the user's password.

Secure Password Authentication Explained Simply[^]
Salted Password Hashing - Doing it Right[^]

You are missing the opening part...
After creating a new connection object you should open the connection, like this:
C#
con.Open


https://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlconnection(v=vs.110).aspx[^]
 
Share this answer
 
Comments
Richard Deeming 1-Dec-15 8:43am    
The data adapter takes care of opening and closing the connection for you. There's no need to explicitly open the connection before calling the Fill method.
Firstly it is creating SqlConnection object but not open connection.

Secondly always use parameterized query to avoid SQL Injection. Here is the complete code:
C#
SqlConnection con = new SqlConnection("Data Source=USER-PC;Initial Catalog=Test;Integrated Security=True");
con.Open();

SqlDataAdapter sda = new SqlDataAdapter("select role from login where username = @uid and password = @pwd",con);
da.SelectCommand.Parameters.AddWithValue("@uid", textBox1.Text);
da.SelectCommand.Parameters.AddWithValue("@pwd", textBox2.Text);

DataTable dt = new DataTable();
sda.Fill(dt);

if (dt.Rows.Count==1)
{
  // Your logic
}

con.Close();
 
Share this answer
 
v2
Comments
Richard Deeming 1-Dec-15 8:44am    
The data adapter takes care of opening and closing the connection for you. There's no need to explicitly open the connection before calling the Fill method.
C#
SqlConnection con=new SqlConnection("Data Source=USER-PC;Initial Catalog=Test;Integrated Security=True");
SqlCommand cmd=new SqlCommand();
SqlDataAdapter ada=new SqlDataAdapter();
DataTable dt=new DataTable();

cmd.Connection=con;
cmd.CommandText="select role from login where username='" + textBox1.Text + "' and password='" + textBox2.Text + "' ";
ada.SelectCommand=cmd;
ada.Fill(dt);

if(dt.Rows.Count>0)
{
this.Hide();
   MDIParent1 kk = new MDIParent1();
   kk.Show();

}


OR


C#
SqlConnection con=new SqlConnection("Data Source=USER-PC;Initial Catalog=Test;Integrated Security=True");
SqlCommand cmd=new SqlCommand();
SqlDataAdapter ada=new SqlDataAdapter();
DataTable dt=new DataTable();
 
cmd.Connection=con;
cmd.CommandText="select role from login where username=@username and password=@password ";
cmd.Parameters.AddWithValue("@username",textBox1.Text.Trim());
cmd.Parameters.AddWithValue("@password",textBox2.Text.Trim());
ada.SelectCommand=cmd;
ada.Fill(dt);
 
if(dt.Rows.Count>0)
{
this.Hide();
   MDIParent1 kk = new MDIParent1();
   kk.Show();
 
}
 
Share this answer
 
v2
Comments
Richard Deeming 1-Dec-15 9:02am    
Avoid the first option at all costs! SQL Injection[^] is a very dangerous security vulnerability.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900