Click here to Skip to main content
15,898,374 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
string verifyinfo = "select imagelist, pass from Gpass where userid=" + txtuserid.Text + "email=" + txtemail.Text;
Posted

User id and email would be text fields so you would need to use '' with them in the query. Also you have a missing AND.
E.g.
"select imagelist, pass from Gpass where userid='" + txtuserid.Text + "' and email='" + txtemail.Text + "'"; <br />

However, also note that write inline queries like this could lead to SQL Injection[^].
Use parameters instead.
 
Share this answer
 
Hi,

You forgot apostrophes, and you forgot an AND or OR:
C#
string verifyinfo = "select imagelist, pass from Gpass where userid='" + txtuserid.Text + "' AND email='" + txtemail.Text + "'";

But don't use string concatenation to build queries, because using string concatenation doesn't prevent SQL injection[^]. Use a SqlParameter to pass a parameter:
http://msdn.microsoft.com/en-us/library/system.data.sqlclient.sqlparameter.aspx[^]
http://www.dotnetperls.com/sqlparameter[^]

If you use a SqlParameter, try this code:
C#
using (SqlCommand command = new SqlCommand("select imagelist, pass from Gpass where userid=@userid AND email=@email", connection))
	    {
		command.Parameters.Add(new SqlParameter("userid", txtuserid.Text));
		command.Parameters.Add(new SqlParameter("email", txtemail.Text));
		SqlDataReader reader = command.ExecuteReader();
		// some other code
	    }

I recommend to use SqlParameter to prevent SQL injection.
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900