Error occur in CSharp

sumaira manzoor hussain khan

hello everyone;

i am writing a code . in the colored area ,there are exception occur .the exception are :

The text, ntext, and image data types cannot be compared or sorted, except when using IS NULL or LIKE operator.

protected void Button_login_Click(object sender, EventArgs e)
{
object obj = null;
SqlConnection mycon = new SqlConnection();
mycon=connection.get();
//mycon = connection.get();
Session["username"] = TextBox_user_name.Text;
Session["password"] = TextBox_password.Text;
string s = "select count(*) from login where user_name='" + Session["username"] + "' and password ='" + Session["password"] + "'";
SqlCommand cmd = new SqlCommand(s, mycon);
obj = cmd.ExecuteScalar();
if (Convert.ToInt32(obj) != 0)
{
Label_display_user_name.Text = "WELLCOME :: " + Session["user_name"];
}
else
{
Label_result.Text = "invalid user name and password";
}

}

regards
sumaira

6 Replies

Know the answer? Post it — somebody with the same question will find it here.

Narayan15y ago
Accepted answer
May I know what data type you have used for user_name and password in login table.
try to use nvarchar(50), it will work.
One more thing why you are adding username and password to session
and using it, instead you can directly use them from the textbox.

Its not a good idea to store password in session.

Thanks
Narayan15y ago
Modified your code with SQL parameters

protected void Button_login_Click(object sender, EventArgs e)
    {
        object obj = null;
        SqlConnection mycon = new SqlConnection();
        mycon = connection.get();

        string s = "select count(*) from login where user_name=@user_name and password =@password";
        SqlCommand cmd = new SqlCommand(s, mycon);
        cmd.CommandType = CommandType.Text;
        cmd.Parameters.AddWithValue("@user_name", TextBox_user_name.Text);
        cmd.Parameters.AddWithValue("@password", TextBox_password.Text);
        obj = cmd.ExecuteScalar();
        if ((int)(obj) != 0)
        {
            Label_display_user_name.Text = "WELLCOME :: " + TextBox_user_name.Text;
        }
        else
        {
            Label_result.Text = "invalid user name and password";
        }

    }
Satish Bhat15y ago
To prevent SQL injection, use command parameters for SQL queries.
To know more about SQL Injection and Parameterized Queries Read this.
sumaira manzoor hussain khan15y ago
hello sir;

thank you very much for your help. my exception has been solved. i changed my datatype as well as session. so this is my real code.

protected void Button_login_Click(object sender, EventArgs e)
{
object obj = null;
SqlConnection mycon = new SqlConnection();
mycon=connection.get();
string s = "select count(*) from login where user_name='"+ TextBox_user_name.Text + "' and password ='" +TextBox_password.Text + "'";
SqlCommand cmd = new SqlCommand(s,mycon);
obj = cmd.ExecuteScalar();
if ((int)(obj) != 0)
{
Label_display_user_name.Text = "WELLCOME :: " + TextBox_user_name.Text;
}
else
{
Label_result.Text = "invalid user name and password";
}

}

regards
sumaira
sumaira manzoor hussain khan15y ago
hello sir;

sir, i am using text datatype for username and password.
Sam Hobbs15y ago
What data type are username and password?