Username & pwd verification ?

Question

Hi

Is there any way out to verify username and password using sql query to DB ..

Well actually i pre-requisite is i have say many columns i,e password and usernames ... so on

I used query like this

cmd = new SqlCommand("select username,password from studentform where username = " '+textbox1.text' and password= " '+textbox2.text ' " ,con);

con.Open();

SqlDataReader dr = cmd.ExecuteReader();

if (dr.Read())

{

Server.Transfer("studentafterlogin.aspx");

}

else

{

Response.Write("<script> alert('Invalid credentials')</script>");

}

In above in my command , The select statement NOT WORKING PROPERLY i am not getting anything to datareader EVEN i given correct credentials ?? Problem in query ??

Help it please ....

Vulpes · Answer

The query doesn't look quite right. Try this: cmd = new SqlCommand(select usernamepassword from studentform where username = ' +TextBox1.Text + ' and password= ' +TextBox2.Text + ' con);

Vulpes · Answer

Well as you know strings have to be enclosed in single quotes in SQL queries. When the string to be inserted in the query is a C# variable (such as TextBox1.Text) the contents of the variable need to be surrounded by single quotes. As these single quotes aren't usually embedded in the variable itself they have to be included in the strings either side of the variable to which it is being concatenated. You can do this by trying to visualize how the query will eventually look as we've done above which is obviously quite error prone. However there are two alternative ways of doing it which make life a little easier. The best way is to always use parameters rather than variables or hard-coded strings. As well as guarding against SQL injection you don't need to worry whether what's inserted needs to be surrounded by single quotes or not with this approach. The other way is to use the String.Format method which makes the final string easier to visualize. If we'd done that above we'd have used: cmd = new SqlCommand(String.Format(select usernamepassword from studentform where username = '{0}' and password='{1}' TextBox1.Text TextBox2.Text) con);

SUNIL GUTTA · Answer

Yes that's a gem of an explanation :) Ty and have a nice day .. If there is any free time scheduled for u please can you refer my previous post regarding some ample work on MASTER PAGE .. .. Just suggest in that case master page is advisable or not

SUNIL GUTTA · Answer

cheers thanks mate :) its been very helpful Word of advice please : how to make these ' & '' work correctly as you made in above query .. When to start with single ( ' ) and fallowed by (  ) .. Thank you