Incorrect syntax near 'email'

Question

0.00/5 (No votes)

See more:

im new to sql. Im suppose to write code that can let me check the user input for email and password against the database.

Below is the code i've written

C#

protected void btnLogin_Click(object sender, EventArgs e)
    {
        string strEmail, strPwd, strSel;
        int intShopperID;
        DatabaseMgmt loginObj = new DatabaseMgmt();
       //read e-mail and password that are entered in the textboxes
        strEmail = emailTextBox.Text.ToLower();
        strPwd = pwdTextBox.Text.Trim();
        strSel = "SELECT ShopperID" +
            "FROM Shopper" +
            "WHERE Email = '" + strEmail + "'" +
            "AND Passwd = '" + strPwd + "'";

        SqlDataReader dR = loginObj.ExecuteSelect(strSel);
        



            if (dR.Read())
            {
                intShopperID = 1;
                Session["shopperID"] = intShopperID;
                Response.Redirect("Default.aspx");
            }

            else
            {
                intShopperID = 0;
                lblMsg.Text = "Incorrect email or password!";
                lblMsg.ForeColor = System.Drawing.Color.Red;
            }
        
    }

What I have tried:

im dont know how to continue from here :(

Posted 16-Aug-16 1:50am

Member 12688019

Updated 16-Aug-16 2:02am

F-ES Sitecore

v2

Add a Solution

Comments

Richard Deeming 16-Aug-16 9:14am

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

Richard Deeming 16-Aug-16 9:14am

Also, never store passwords in plain text. That's a security breach waiting to happen.

Secure Password Authentication Explained Simply[^]
Salted Password Hashing - Doing it Right[^]

2 solutions

Solution 1

You need to learn to use the debugger

Mastering Debugging in Visual Studio 2010 - A Beginner's Guide[^]

Inspect the content of your variables, such as strSel, what does it contain?

SQL

SELECT ShopperIDFROM ShopperWHERE Email = 'me@here.com'AND Passwd = '123456'

Is that valid SQL?

Also read on using parameterised queries to build your SQL as your code might be open to SQL Injection attacks.

Posted 16-Aug-16 1:58am

F-ES Sitecore

Comments

sja63 16-Aug-16 8:02am

I think its better to use:

strEmail = emailTextBox.Text.ToLower().Trim();

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

njammy · Accepted Answer · 2016-08-16T02:02:00

Your SQL does not have spaces in correct places.

Also see my sample below to see a better way to select query data using user input in SQL to avoid SQL injection:

C#

string userEmail = "test@email.com", userPassword = "abc123";
		
		// Your SQL:
		Console.WriteLine("SELECT ShopperID" + "FROM Shopper" + "WHERE Email = '" + "a@b.com" + "'" + "AND Passwd = '" + "password" + "'");
		// Outputs: SELECT ShopperIDFROM ShopperWHERE Email = 'a@b.com'AND Passwd = 'password'
		
		// Better way to do it:
		string sql = "SELECT ShopperID FROM Shopper WHERE Email = {0} AND Passwd = {1}";
		string emailParameter = "@Email", passwordParameter = "@Password";
		string formattedSql = string.Format(sql,emailParameter,passwordParameter);
		Console.WriteLine(formattedSql);
		
		// Use parameterised sql command
		SqlCommand cmd = new SqlCommand(formattedSql);
		cmd.Parameters.Add(new SqlParameter(emailParameter,userEmail));
		cmd.Parameters.Add(new SqlParameter(passwordParameter,userPassword));
		
		SqlDataReader dr = cmd.ExecuteReader();
		// Continue your code...