Not able to activate / deactivea (add / update / delete) buttons as per role

Question

1.00/5 (1 vote)

See more:

Dear All,

Below is login form and code form, but i am not able to active add / update / delete button as per role, i am trying to pass role from form3 to form1,

login form :

C#

using System;  
    using System.Collections.Generic;  
    using System.ComponentModel;  
    using System.Data;  
    using System;  
    using System.Collections.Generic;  
    using System.ComponentModel;  
    using System.Data;  
    using System.Drawing;  
    using System.Linq;  
    using System.Text;  
    using System.Threading.Tasks;  
    using System.Windows.Forms;  
    using System.IO;  
    using MySql.Data.MySqlClient;  
      
    namespace PhoneBook  
    {  
    public partial class Form3 : Form  
    {  
    public Form3()  
    {  
    InitializeComponent();  
    }  
    private void Form3_Load(object sender, EventArgs e)  
    {  
    }  
    private void button1_Click(object sender, EventArgs e)  
    {  
    this.Close();  
    }  
    private void button2_Click(object sender, EventArgs e)  
    {  
    MySqlConnection connection = new MySqlConnection("Server=xxx.xxx.xxx.xxx;port=xxxx;Database = xxxx; Uid =xxxx;Password =xxxx;connection Timeout=60");  
    MySqlDataAdapter sda = new MySqlDataAdapter("Select Role From LOGIN2 where USERNAME = '" + textBox1.Text + "' and PASSWORD = '" + textBox2.Text + "'", connection);  
    DataTable dt = new DataTable();  
    sda.Fill(dt);  
    if (dt.Rows.Count == 1)  
    {  
    this.Hide();  
    Form1 ss = new Form1(dt.Rows[0][0].ToString());  
    ss.Show();  
    }  
    else  
    {  
    MessageBox.Show("please check you user name and password");  
    }  
    }  
    }  
    }

Code Form :

C#

using System;  
    using System.Collections.Generic;  
    using System.ComponentModel;  
    using System.Data;  
    using System.Drawing;  
    using System.Linq;  
    using System.Text;  
    using System.Threading.Tasks;  
    using System.Windows.Forms;  
    using MySql.Data.MySqlClient;  
    using System.IO;  
    using System.Drawing.Imaging;  
    // this will be used for pic programming  
    namespace PhoneBook  
    {  
    public partial class Form1 : Form  
    {  
    MySqlConnection connection = new MySqlConnection("Server=xxxxx;port=xxx;Database =xxxxx; Uid =xxxx;Password =xxx;connection Timeout=60");  
    MySqlCommand command;  
    MySqlDataAdapter da;  
    DataTable dt;  
    DataSet ds = new DataSet();  
    public Form1(string Role)  
    {  
    InitializeComponent();  
    label9.Text = Role;  
    textBox4.Visible = false;  
    this.BtnDelete.Enabled = false;  
    this.BtnUpdate.Enabled = false;  
    this.BtnSave.Enabled = false;  
    }  
    private void label3_Click(object sender, EventArgs e)  
    {  
    }  
    private void Form1_Load(object sender, EventArgs e)  
    {  
    connection.Open();  
    da = new MySqlDataAdapter("SELECT * FROM Fakhri2 ORDER BY SlNo desc", connection);  
    dt = new DataTable();  
    da.Fill(dt);  
    dataGridView1.RowTemplate.Height = 60;  
    dataGridView1.DataSource = dt;  
    DataGridViewImageColumn imgCol = new DataGridViewImageColumn();  
    imgCol = (DataGridViewImageColumn)dataGridView1.Columns[7];  
    imgCol.ImageLayout = DataGridViewImageCellLayout.Stretch;  
    dataGridView1.AutoSizeColumnsMode = DataGridViewAutoSizeColumnsMode.Fill;  
    label9.Text = "logged as " + this.Controls["label9"].Text;  
    if(this.Controls["label9"].Text == "Admin")  
    {  
    this.BtnDelete.Enabled = true;  
    this.BtnUpdate.Enabled = true;  
    this.BtnSave.Enabled = true;  
    }  
    if (this.Controls["label9"].Text == "Client")  
    {  
    BtnDelete.Enabled = false;  
    BtnUpdate.Enabled = false;  
    BtnSave.Enabled = false;  
    }  
    if (this.Controls["label9"].Text == "Cust")  
    {  
    this.BtnDelete.Enabled = false;  
    this.BtnUpdate.Enabled = false;  
    this.BtnSave.Enabled = true;  
    }  
    connection.Close();  
    }  
    private void BtnSave_Click(object sender, EventArgs e)  
    {  
    if (textBox1.Text == "" || textBox2.Text == "")  
    {  
    MessageBox.Show("Please Enter Details");  
    }  
    else  
    {  
    command = new MySqlCommand("SELECT * FROM TblPhoneBook WHERE MobileNo = '" + textBox2.Text + "' ", connection);  
    MySqlDataAdapter da = new MySqlDataAdapter(command);  
    da.Fill(ds);  
    int i = ds.Tables[0].Rows.Count;  
    if (i > 0)  
    {  
    MessageBox.Show("mobile no " + textBox2.Text + " Already Exist");  
    ds.Clear();  
    }  
    else  
    {  
    try  
    {  
    MemoryStream ms = new MemoryStream();  
    pictureBox1.Image.Save(ms, pictureBox1.Image.RawFormat);  
    byte[] img = ms.ToArray();  
    connection.Open();  
    command = new MySqlCommand("INSERT INTO Fakhri2(CustName, InvNo, Dtd, Amt, Tax, Desc1, PIC)VALUES( @cust, @inv,@dtd, @amt, @tax, @des, @img)", connection);  
    command.Parameters.Add("@cust", MySqlDbType.VarChar).Value = textBox1.Text;  
    command.Parameters.Add("@inv", MySqlDbType.VarChar).Value = textBox2.Text;  
    command.Parameters.Add("@dtd", MySqlDbType.VarChar).Value = dateTimePicker1.Text;  
    command.Parameters.Add("@amt", MySqlDbType.VarChar).Value = textBox5.Text;  
    command.Parameters.Add("@tax", MySqlDbType.VarChar).Value = textBox6.Text;  
    command.Parameters.Add("@des", MySqlDbType.VarChar).Value = textBox7.Text;  
    command.Parameters.Add("@img", MySqlDbType.LongBlob).Value = img;  
    command.ExecuteNonQuery();  
    da = new MySqlDataAdapter("SELECT * FROM Fakhri2 ORDER BY SlNo desc", connection);  
    dt = new DataTable();  
    da.Fill(dt);  
    dataGridView1.DataSource = dt;  
    MessageBox.Show("Customer Record ADDED");  
    connection.Close();  
    }  
    catch (Exception ex)  
    {  
    MessageBox.Show(ex.Message);  
    }  
    }  
    }  
    textBox1.Text = "";  
    textBox2.Text = "";  
    textBox4.Text = "";  
    textBox5.Text = "";  
    textBox6.Text = "";  
    textBox7.Text = "";  
    }  
    private void BtnUpdate_Click(object sender, EventArgs e)  
    {  
    try  
    {  
    MemoryStream ms = new MemoryStream();  
    pictureBox1.Image.Save(ms, pictureBox1.Image.RawFormat);  
    byte[] img = ms.ToArray();  
    connection.Open();  
    command = new MySqlCommand("UPDATE Fakhri2 SET CustName=@cust,InvNo=@inv,Dtd=@dtd,Amt=@amt,Tax=@tax,Desc1 =@des,PIC=@img WHERE SlNo = @SNo", connection);  
    command.Parameters.Add("@cust", MySqlDbType.VarChar).Value = textBox1.Text;  
    command.Parameters.Add("@SNo", MySqlDbType.VarChar).Value = textBox4.Text;  
    command.Parameters.Add("@inv", MySqlDbType.VarChar).Value = textBox2.Text;  
    command.Parameters.Add("@dtd", MySqlDbType.VarChar).Value = dateTimePicker1.Text;  
    command.Parameters.Add("@amt", MySqlDbType.VarChar).Value = textBox5.Text;  
    command.Parameters.Add("@tax", MySqlDbType.VarChar).Value = textBox6.Text;  
    command.Parameters.Add("@des", MySqlDbType.VarChar).Value = textBox7.Text;  
    command.Parameters.Add("@img", MySqlDbType.LongBlob).Value = img;  
    command.ExecuteNonQuery();  
    da = new MySqlDataAdapter("SELECT * FROM Fakhri2 ORDER BY SlNo desc", connection);  
    dt = new DataTable();  
    da.Fill(dt);  
    dataGridView1.DataSource = dt;  
    MessageBox.Show("Contact list update....");  
    connection.Close();  
    }  
    catch(Exception ex)  
    {  
    MessageBox.Show(ex.Message);  
    }  
    textBox1.Text = "";  
    textBox2.Text = "";  
    textBox4.Text = "";  
    textBox5.Text = "";  
    textBox6.Text = "";  
    textBox7.Text = "";  
    }  
    int i;  
    private void dataGridView1_CellDoubleClick(object sender, DataGridViewCellEventArgs e)  
    {  
    i = e.RowIndex;  
    DataGridViewRow row = dataGridView1.Rows[i];  
    textBox1.Text = row.Cells[1].Value.ToString();  
    textBox2.Text = row.Cells[2].Value.ToString();  
    textBox4.Text = row.Cells[0].Value.ToString();  
    dateTimePicker1.Text = row.Cells[3].Value.ToString();  
    textBox5.Text = row.Cells[4].Value.ToString();  
    textBox6.Text = row.Cells[5].Value.ToString();  
    textBox7.Text = row.Cells[6].Value.ToString();  
    Byte[] img = (Byte[])dataGridView1.CurrentRow.Cells[7].Value;  
    MemoryStream ms = new MemoryStream(img);  
    pictureBox1.Image = Image.FromStream(ms);  
    }  
    private void BtnDelete_Click(object sender, EventArgs e)  
    {  
    try  
    {  
    connection.Open();  
    command = new MySqlCommand("Delete FROM Fakhri2 WHERE SlNo = '" + textBox4.Text + "' ", connection);  
    command.ExecuteNonQuery();  
    da = new MySqlDataAdapter("SELECT * FROM Fakhri2 ORDER BY SlNo desc", connection);  
    dt = new DataTable();  
    da.Fill(dt);  
    dataGridView1.DataSource = dt;  
    MessageBox.Show("Contact...DELETED...");  
    connection.Close();  
    }  
    catch (Exception ex)  
    {  
    MessageBox.Show(ex.Message);  
    }  
    textBox1.Text = "";  
    textBox2.Text = "";  
    textBox4.Text = "";  
    textBox5.Text = "";  
    textBox6.Text = "";  
    textBox7.Text = "";  
    }  
    private void textBox3_TextChanged(object sender, EventArgs e)  
    {  
    BindingSource bs = new BindingSource();  
    bs.DataSource = dataGridView1.DataSource;  
    bs.Filter = "CustName like '%" + textBox3.Text + "%'";  
    dataGridView1.DataSource = bs;  
    }  
    private void label1_Click(object sender, EventArgs e)  
    {  
    }  
    private void BTN_CHOOSE_IMAGE_Click(object sender, EventArgs e)  
    {  
    OpenFileDialog opf = new OpenFileDialog();  
    opf.Filter = "Choose Image(*.JPG;*.PNG;*.PDF)|*.jpg;*.png;*.pdf";  
    if (opf.ShowDialog() == DialogResult.OK)  
    {  
    pictureBox1.Image = Image.FromFile(opf.FileName);  
    }  
    }  
    private void label9_Click(object sender, EventArgs e)  
    {  
    }  
    }  
    }

What I have tried:

i tried in to pass value but did not work

Posted 22-Jun-18 22:48pm

juzar Para

Updated 24-Jun-18 10:03am

Blutfaust

v2

Add a Solution

Comments

Richard MacCutchan 23-Jun-18 5:17am

Please format your code properly, remove the code that is not related to the problem, and explain what you did, what result you saw or did not see, and especially what "did not work" actually means.

Richard Deeming 26-Jun-18 13:13pm

Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

Richard Deeming 26-Jun-18 13:14pm

NEVER store passwords in plain text.

Secure Password Authentication Explained Simply[^]
Salted Password Hashing - Doing it Right[^]

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

User 4180254 · Answer 1 · 2018-06-23T16:58:00

Assuming you are able to pass correct role string for Form1 constructor. You can check on below to trace the issue -

1. On Form1 constructor you updated label9.text to show your current role.
2. On Form1_Load event you upadated label9 to should text "logged in user as <current_role>" and then on next line you are checking the currently logged in user as below which will never have only role string now.

if(this.Controls["label9"].Text == "Admin") //as this.Controls["label9"].Text ='logged in user as Admin'
{ 
this.BtnDelete.Enabled = true; 
this.BtnUpdate.Enabled = true; 
this.BtnSave.Enabled = true; 
}

TRy with below code and it should work for you -

public partial class Form1 : Form 
{ 
    ....<your_code>....
    String CurrentUserRole = Stirng.Empty; // to hold current user role

    public Form1(string Role) 
    { 
    InitializeComponent(); 
    CurrentUserRole = Role; 
    label9.Text = CurrentUserRole ; // if really required as you override this on load method
    ....<your_code>....
    } 

private void Form1_Load(object sender, EventArgs e) 
{ 
    ....<your_code>....
    label9.Text = String.Format("logged as {0}", CurrentUserRole ); 
    if(CurrentUserRole  == "Admin") //check current user and set control status
    { 
    this.BtnDelete.Enabled = true; 
    this.BtnUpdate.Enabled = true; 
    this.BtnSave.Enabled = true; 
    } 
    ....<your_code>....

juzar Para · Answer 2 · 2018-07-09T20:54:00

Solution 2

Vinod Jangle

Thank you vinod, it worked as i wanted, once again thank you

Posted 9-Jul-18 20:54pm