Click here to Skip to main content
15,888,590 members
Please Sign up or sign in to vote.
1.00/5 (1 vote)
See more:
I've created a user login using MySql, however when I run the code ...


private void LoginButton_Click(object sender, EventArgs e)
{

SqlConnection sqlcon = new SqlConnection(@"Data Source=HP\SQLEXPRESS;Initial Catalog=Inventory;Integrated Security=True");
string query = "Select * from User Where Username = '" + Username_txt.Text + "' and Password = '" + Password_txt.Text + "'";
SqlDataAdapter sda = new SqlDataAdapter(query, sqlcon);
DataTable dtbl = new DataTable();
sda.Fill(dtbl);

if (dtbl.Rows.Count == 1)
{
Dashboard mainForm = new Dashboard();
this.Hide();
mainForm.Show();
}
else
{
MessageBox.Show("Check your username and password");
}
}

i get the error of ...

"An unhandled exception of type 'System.Data.SqlClient.SqlException' occurred in System.Data.dll

Additional information: Incorrect syntax near the keyword 'User'. "
whilst it highlights " sda.Fill(dtbl);"

What I have tried:

re-writing the code, double checking connection
Posted
Updated 4-Dec-17 2:35am
Comments
Richard MacCutchan 4-Dec-17 8:41am    
Please do not store passwords as clear text. And do not use string concatenation to create SQL commands.
Member 13512434 4-Dec-17 10:31am    
hi, I understand its bad practice but what should I use instead?
Richard MacCutchan 4-Dec-17 11:20am    
It's not just bad practice, it is extremely dangerous. Use parameterised queries for your database commands, and use salted hashes for passwords.

1 solution

USER is a reserved MySQL keyword (and PASSWORD too). When using such as identifiers like table or field names, they must be quoted or preceded by the table name for fields.

See MySQL :: MySQL 5.7 Reference Manual :: 9.3 Keywords and Reserved Words[^].
 
Share this answer
 

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900