Click here to Skip to main content
14,384,711 members
   

C#

 
AnswerRe: Code not splitting for login form. C# Pin
OriginalGriff11-Nov-19 2:32
protectorOriginalGriff11-Nov-19 2:32 
NewsRe: Code not splitting for login form. C# Pin
Eddy Vluggen11-Nov-19 4:20
mveEddy Vluggen11-Nov-19 4:20 
QuestionQuestion Pin
Member 1450924010-Nov-19 2:39
memberMember 1450924010-Nov-19 2:39 
QuestionRe: Question Pin
Richard MacCutchan10-Nov-19 2:44
protectorRichard MacCutchan10-Nov-19 2:44 
AnswerRe: Question Pin
OriginalGriff10-Nov-19 2:48
protectorOriginalGriff10-Nov-19 2:48 
AnswerRe: Question Pin
Eddy Vluggen10-Nov-19 2:51
mveEddy Vluggen10-Nov-19 2:51 
QuestionHow to disable other buttons based on user role login Pin
Member 146022408-Nov-19 23:05
memberMember 146022408-Nov-19 23:05 
AnswerRe: How to disable other buttons based on user role login Pin
OriginalGriff8-Nov-19 23:30
protectorOriginalGriff8-Nov-19 23:30 
I know you are a student, but ... don't do it like that!

Never concatenate strings to build a SQL command. It leaves you wide open to accidental or deliberate SQL Injection attack which can destroy your entire database. Always use Parameterized queries instead.

When you concatenate strings, you cause problems because SQL receives commands like:
SELECT * FROM MyTable WHERE StreetAddress = 'Baker's Wood'
The quote the user added terminates the string as far as SQL is concerned and you get problems. But it could be worse. If I come along and type this instead: "x';DROP TABLE MyTable;--" Then SQL receives a very different command:
SELECT * FROM MyTable WHERE StreetAddress = 'x';DROP TABLE MyTable;--'
Which SQL sees as three separate commands:
SELECT * FROM MyTable WHERE StreetAddress = 'x';
A perfectly valid SELECT
DROP TABLE MyTable;
A perfectly valid "delete the table" command
--'
And everything else is a comment.
So it does: selects any matching rows, deletes the table from the DB, and ignores anything else.

So ALWAYS use parameterized queries! Or be prepared to restore your DB from backup frequently. You do take backups regularly, don't you?

You know how to use them, so ignoring that for your login page is just plain stupid, as
1) Anyone can log in as any user without needing a password.
2) Anyone can delete your DB without even having a valid username!

To add to that, a cardinal sin: Storing passwords in plain text[^]
Never store passwords in clear text - it is a major security risk. There is some information on how to do it here: Password Storage: How to do it.[^]

And remember: if you have any European Union users then GDPR applies and that means you need to handle passwords as sensitive data and store them in a safe and secure manner. Text is neither of those and the fines can be .... um ... outstanding. In December 2018 a German company received a relatively low fine of €20,000 for just that.
"I have no idea what I did, but I'm taking full credit for it." - ThisOldTony
AntiTwitter: @DalekDave is now a follower!

AnswerRe: How to disable other buttons based on user role login Pin
Richard MacCutchan8-Nov-19 23:53
protectorRichard MacCutchan8-Nov-19 23:53 
GeneralRe: How to disable other buttons based on user role login Pin
Mycroft Holmes9-Nov-19 11:21
memberMycroft Holmes9-Nov-19 11:21 
GeneralRe: How to disable other buttons based on user role login Pin
OriginalGriff9-Nov-19 11:35
protectorOriginalGriff9-Nov-19 11:35 
GeneralRe: How to disable other buttons based on user role login Pin
Richard MacCutchan9-Nov-19 21:53
protectorRichard MacCutchan9-Nov-19 21:53 
GeneralRe: How to disable other buttons based on user role login Pin
Mycroft Holmes10-Nov-19 11:08
memberMycroft Holmes10-Nov-19 11:08 
AnswerRe: How to disable other buttons based on user role login Pin
BillWoodruff9-Nov-19 21:31
mveBillWoodruff9-Nov-19 21:31 
GeneralRe: How to disable other buttons based on user role login Pin
Eddy Vluggen10-Nov-19 3:01
mveEddy Vluggen10-Nov-19 3:01 
GeneralRe: How to disable other buttons based on user role login Pin
BillWoodruff10-Nov-19 5:24
mveBillWoodruff10-Nov-19 5:24 
GeneralRe: How to disable other buttons based on user role login Pin
Eddy Vluggen10-Nov-19 7:16
mveEddy Vluggen10-Nov-19 7:16 
GeneralRe: How to disable other buttons based on user role login Pin
Richard MacCutchan10-Nov-19 5:49
protectorRichard MacCutchan10-Nov-19 5:49 
GeneralRe: How to disable other buttons based on user role login Pin
Eddy Vluggen10-Nov-19 7:14
mveEddy Vluggen10-Nov-19 7:14 
GeneralRe: How to disable other buttons based on user role login Pin
Richard MacCutchan10-Nov-19 7:20
protectorRichard MacCutchan10-Nov-19 7:20 
GeneralRe: How to disable other buttons based on user role login Pin
Eddy Vluggen10-Nov-19 8:32
mveEddy Vluggen10-Nov-19 8:32 
GeneralRe: How to disable other buttons based on user role login Pin
BillWoodruff10-Nov-19 7:47
mveBillWoodruff10-Nov-19 7:47 
GeneralRe: How to disable other buttons based on user role login Pin
Eddy Vluggen10-Nov-19 8:45
mveEddy Vluggen10-Nov-19 8:45 
GeneralRe: How to disable other buttons based on user role login Pin
Eddy Vluggen10-Nov-19 9:01
mveEddy Vluggen10-Nov-19 9:01 
GeneralRe: How to disable other buttons based on user role login Pin
BillWoodruff10-Nov-19 12:06
mveBillWoodruff10-Nov-19 12:06 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.