c sharp windows alpplication creating login form

Question

0.00/5 (No votes)

See more:

hi i just i take 2 lables and 2 textboxes and 1 button
i just write the code in button

C#

if (textBox1.Text != "" & textBox2.Text != "")
           {
               string queryText = "SELECT Count(*) FROM Login " +
                                  "WHERE username = @User name AND password = @Password";
               using (SqlConnection cn = new SqlConnection("Data Source=MIS-PC;Initial Catalog=project;Integrated Security=True"))
               using (SqlCommand cmd = new SqlCommand(queryText, cn))
               {
                   cn.Open();
                   cmd.Parameters.AddWithValue("@User name", textBox1.Text);  // cmd is SqlCommand
                   cmd.Parameters.AddWithValue("@Password", textBox2.Text);
                   int result = (int)cmd.ExecuteScalar();
                   if (result > 0)
                       MessageBox.Show("Loggen In!");
                   else
                       MessageBox.Show("User Not Found!");
               }

but its not working

Error in this line
int result = (int)cmd.ExecuteScalar();

how to do

Posted 14-Apr-14 20:47pm

hilbert hussen

Updated 14-Apr-14 22:24pm

v3

Add a Solution

Comments

Dinesh.V.Kumar 15-Apr-14 2:49am

What is the error you are getting?

hilbert hussen 15-Apr-14 4:47am

{"Incorrect syntax near 'nvarchar'.\r\nAn expression of non-boolean type specified in a context where a condition is expected, near 'name'."}

int result = (int)cmd.ExecuteScalar();

Dinesh.V.Kumar 15-Apr-14 4:52am

Instead of @User name change it to @Username and check...

hilbert hussen 15-Apr-14 4:57am

Incorrect syntax near 'nvarchar'.
Must declare the scalar variable "@Username".

again came error

Dinesh.V.Kumar 15-Apr-14 6:17am

did you replace @User name in both the places in your code?

Ankur^\m/ 15-Apr-14 2:58am

You are saying windows application but you have tagged your question ASP.NET which is a web technology.
You say it is not working, but you give us no details. How would we know what is not working. Do you get any error/exception? You must specify what's wrong with and if you have already debugged which line is causing issue.
Use 'Improve Question' link to update your question.

3 solutions

Solution 2

abhishek_singh is right - you need a connection string to connect to your db, but in addition...
Please, please, don't do things like that!
There are two major mistakes you are making here:
1) Do not concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Use Parametrized queries instead. As your code stands, I do not need a password to log in as anybody!
2) Never store passwords in clear text - it is a major security risk. There is some information on how to do it here: Password Storage: How to do it.[^]

Posted 14-Apr-14 21:17pm

OriginalGriff

Comments

hilbert hussen 15-Apr-14 6:03am

Incorrect syntax near 'nvarchar'.
Must declare the scalar variable "@Username".

again came error

OriginalGriff 15-Apr-14 6:34am

Yes - because your new code which uses parameters doesn't pass the actual parameter data.
Take the space out of the "@User Name" - it's a variable, so variable rules apply - call it "@UserName" instead in both places.

hilbert hussen 15-Apr-14 7:06am

YES ,BUT I DID THAT ALSO..NOT COMMING

OriginalGriff 15-Apr-14 7:22am

DON'T SHOUT. Using all capitals is considered shouting on the internet, and rude (using all lower case is considered childish). Use proper capitalisation if you want to be taken seriously.

hilbert hussen 16-Apr-14 3:16am

not comming

OriginalGriff 16-Apr-14 3:59am

What does "not comming" mean?
Show us the exact code you are now using, and tell us what error(s) you are getting now.

hilbert hussen 16-Apr-14 4:49am

SqlConnection cn = new SqlConnection("Data Source=MIS-PC;Initial Catalog=Projecthotel;Integrated Security=True");

string strCmd = "select User name, Password from login where User name='" + textBox1.Text + "' and Password ='" + textBox2.Text + "'";
SqlCommand cmd = new SqlCommand(strCmd, cn);
SqlDataAdapter da = new SqlDataAdapter(strCmd, cn);
DataSet ds = new DataSet();
cn.Open();
cmd.ExecuteNonQuery();
da.Fill(ds);
cn.Close();
MessageBox.Show("Login successful", "Success", MessageBoxButtons.OK, MessageBoxIcon.Information);
Form2 form1 = new Form2();

form1.Close();

here error in
An expression of non-boolean type specified in a context where a condition is expected, near 'name'.

OriginalGriff 16-Apr-14 5:13am

So...you didn't listen to a thing I said then?
You are still concatenating strings - which is still very dangerous.
You are still storing your passwords as text.
And you still have a space in "User name"...

If you must have SQL columns with spaces in (and I don't recommend it) then you need to tell SQL where the name starts and ends: "[User name]" instead of "User name" in both places in your SQL will do it - but please, for your own sake - address the other points as well...I'm not joking, or typing for the sake of it. As your code exists, I can login in as any user I want without even needing a password! Or delete your database from the login screen...

hilbert hussen 16-Apr-14 6:33am

Thanku sir,but iam giving any user name and pwd it showing successful

OriginalGriff 16-Apr-14 6:47am

Yes, it works: but it's very dangerous because of *how* it works.
Try something for me:
Run your application and type this in the username box:
x' OR [User name] != '';--
Leave the password blank.
Press the button.
Are you logged in?
Now, backup your database and try again. This time, your username is:
x'; DROP TABLE login;--
Now look at your database and work out what happened to all your users...before restoring your database.

hilbert hussen 16-Apr-14 6:54am

also its showing successful

Solution 3

replace @User name with @Username on both place, then again run that code.

Posted 15-Apr-14 0:12am

abhishek_singh

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

abhishek_singh · Accepted Answer · 2014-04-14T21:10:00

Solution 1

you have not provided sql connection in to

sqlconnection con=new sqlconnection();

please provide connection string on that so that connect with database, if any other issue let me know about that, also please clear your question.

Posted 14-Apr-14 21:10pm

abhishek_singh

Comments

OriginalGriff 15-Apr-14 3:15am

My down vote countered - I need more coffee...