Click here to Skip to main content
15,881,852 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more: , +
i need one help friends.
i have created a login page in window base application using C# codes.
when i insert userid and password inside the textbox1 and textbox2 and one click the login button then it is working. and form is redirecting normally . but after closing the form2 instead of login page. when i click again on the login button then nothing happens.form1 does not redirect again ..my codes are blow
i want whenever i click on the login button(button4) . form should beme redirect every time.

button4 is the login button .

C#
private void button4_Click(object sender, EventArgs e)
{

    try
    {
        con = new SqlConnection("Data Source=.;Initial Catalog=DSIIDC2;Integrated Security=True");
        cmd = new SqlCommand("select * from login where username='" + txtusername.Text + "' and password='" + txtpassword.Text + "' and role='admin01'", con);
        SqlDataAdapter da = new SqlDataAdapter(cmd);
        DataTable datatab = new DataTable();
        da.Fill(datatab);
        if ("admin" == txtusername.Text && "dsiidc" == txtpassword.Text && "admin01" == "admin01")
        {
            //Session["userone"] = TextBox1.Text;

            frm2.Show();


        }
        else if (("admin" == txtusername.Text && "admin" == txtpassword.Text && "admin02" == "admin02"))
        {

            ad.Show();
            da.Dispose();

        }
        else
        {
            txtpassword.Text = "";
            txtpassword.Text = "";


        }

    }

    catch (Exception ex)
    {
        MessageBox.Show("Please Enter User name and password");
    }


}
Posted
Updated 5-Jun-15 3:01am
v3
Comments
Sinisa Hajnal 5-Jun-15 6:24am    
Try entering the following into your txtusername.Text:
'; alter table login add sqlInjection VARCHAR(1024); --

Your code has several big errors:
1. NEVER EVER use user input directly in your SQL
2. You are comparing the entries with hard-coded admin user and password...what will happen if someone uses reflection on your code and gets them?
3. You should have try..catch..finally around database access and call dispose on command and connection objects (close them properly)
4. why do you have && "admin01" == "admin01" this will always be true...not necessary in the comparison
5. The code in question contains no redirects...what should redirect where?
6. By redirects (and commented out Session) it seems you're working on ASP.NET app and yet you use "base window app" in your question - which I read as winforms...maybe mistakenly.

Please improve the question to make it clearer (use Improve question link). Thank you.
Richard Deeming 5-Jun-15 9:04am    
You missed a problem - the passwords in the database are stored in plain text. Although, as you pointed out, they're never used in this code.

Given the frm2.Show() line, I suspect it is a WinForms or WPF application. If it is ASP.NET, then the MessageBox.Show call would be yet another problem with the code.
Sinisa Hajnal 5-Jun-15 15:34pm    
I could live with readable passwords in suitably protected database. I wouldn't do it, but I've seen it done. Even plaintext config file with connection strings. This one isn't protected.

Yes, I thought it is winforms app, but got thrown by references to redirects and Session object...
ZurdoDev 5-Jun-15 7:47am    
Just debug it.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900