Click here to Skip to main content
15,884,629 members
Please Sign up or sign in to vote.
0.00/5 (No votes)
See more:
hey guys, i'm new to programming and i have started a Loging system using access database but im getting syntex error. i searched a lot in internet but not getting how to solve plz help...
my code is
C#
using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Data.OleDb;

namespace Final
{
    public partial class Login : Form
    {
        private OleDbConnection connection = new OleDbConnection();
        public Login()
        {
            InitializeComponent();
            connection.ConnectionString = @"Provider=Microsoft.ACE.OLEDB.12.0;Data Source=C:\Users\SunilK\Desktop\Final\Final\DB\Login.accdb;
Persist Security Info=False;";
        }

        private void Login_Load(object sender, EventArgs e)
        {
            try
            {
                connection.Open();

                CHKConn.Text = "Connected Sucessfully";

                connection.Close();
            }
            catch (Exception snk)
            {
                MessageBox.Show("Error  " + snk);
            }
        }

        private void textBox2_TextChanged(object sender, EventArgs e)
        {

        }

        private void btnLogin_Click(object sender, EventArgs e)
        {
            connection.Open();

            OleDbCommand command = new OleDbCommand();
            command.Connection = connection;
            command.CommandText = "select count(*) from [LoginDB] where (Username ='" + txtUsername.Text + "') = (Password'" + txtPassword.Text + "')";

            OleDbDataReader reader = command.ExecuteReader();
            int count = 0;
            while (reader.Read())
            {
                count = count + 1;
            }

            if (count == 1)
            {
                MessageBox.Show("Login Sucessfully");
            }
            else
            {
                MessageBox.Show("Login unSucessfully");
            }
            connection.Close();
        }
    }
}


thanks in advance for your help
Posted
Updated 8-Apr-20 16:47pm
v2

Because you're not using parameterized queries your result SQL statement looks like this:
select count(*) from [LoginDB] where (Username ='username') = (Password'password')

See anything wrong with that statement?

Because of the string concatenation stuff you're not seeing the problem in your code. Use parameterized queries instead and the code becomes much easier to read.
CommandText = "Select COUNT(*) FROM [LoginDB] WHERE Username = @username AND Password = @password";


Google for "C# Parameterized Queries" for a lot more discussion and examples.

Google for "SQL Injection" to find out why what you're currently doing is so insecure and dangerous.

Google for "How to store passwords" to find out why storing passwords in plain text is making your security problem even worse.
 
Share this answer
 
Comments
George Jonsson 14-Mar-15 23:20pm    
You beat me to it and with a much better explanation too.
PIEBALDconsult 14-Mar-15 23:41pm    
(Not to mention Access.)
Member 10632254 15-Mar-15 0:41am    
thanks got the answer ...
This line looks incorrect
C#
command.CommandText = "select count(*) from [LoginDB] where (Username ='" + txtUsername.Text + "') = (Password'" + txtPassword.Text + "')";

try
C#
command.CommandText = "select count(*) from [LoginDB] where (Username ='" + txtUsername.Text + "') AND (Password ='" + txtPassword.Text + "')";


[Edit]
Removed extra citation mark before Password
 
Share this answer
 
v3
Comments
Member 10632254 15-Mar-15 0:26am    
i try command.CommandText = "select count(*) from [LoginDB] where (Username ='" + txtUsername.Text + "') AND ('Password ='" + txtPassword.Text + "')"; but still error....
George Jonsson 15-Mar-15 0:33am    
See my update.
Member 10632254 15-Mar-15 0:41am    
thank you so much ..... finally know what is mistake ... now i know it was a silly mistake .... but thanks
George Jonsson 15-Mar-15 0:56am    
Don't beat yourself too much.
It is very easy to get frustrated and blind and miss the obvious.
Get a cup of coffee, take a walk, go to the bathroom and smell the roses.
It helps to go take a break and then come back to the problem with a refreshed mind.
Dear sir/Madam
I had tried to execute the app many times but still not work it shows the message the syntax error (missing operator) please help me how to resolve this problem

Thanks very much!!


private void btnSave_Click(object sender, EventArgs e)
{
//purchase table

{
string str = "INSERT INTO Sales (Invoice,CustomerName,SaleDate,TotalAmt,VAT,Discount,TotalPayAmt,Paid,Balance) VALUES ("+ Invoice_tx.Text +", '"+ CustomerName_cb.Text +"', '"+ SaleDate_dt.Value.Date.ToString() +"', "+ TotalAmnt_tx.Text +", "+ VAT_tx.Text +", "+ Discount_tx.Text +", "+ TotalPayAmnt_tx.Text +",​​​ "+ Paid_tx.Text +", "+ Balance_tx.Text +") ";

OleDbDataAdapter da = new OleDbDataAdapter(str, conn);
//DataSet ds = new DataSet();
DataTable dt = new DataTable();
da.Fill(dt);

}
 
Share this answer
 
Comments
CHill60 9-Apr-20 4:04am    
If you have a question then use the red "Ask a Question" link at the top of the page. Do not post questions or comments as "solutions" to another member's post.
This is for your benefit - more people will see your question and possibly be able to help. They will also have somewhere to reply with a solution.
I suggest you delete this post to avoid downvotes

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900