how to write the querry at the login with user name given but password is null

charan sekhar

16y3.5k.NET

Hi ,
iam using asp.net2.0 with c# with backend sql server 2000.

in my database some user dosent have password (null)
and some user having password .when iam checking the user it is giving message invalid user or password.
can you correct my querry which helps me

 SqlCommand cmd = new SqlCommand("select * from Usersprogrammer where UserName='" + txtusername.Text + "' and OrPassword='"+txtpassword.Text+"'", con);

2 Replies

Know the answer? Post it — somebody with the same question will find it here.

zhong chen16y ago

txtusername.Text.Replace("'","''") and password replace also
or 
use sql param
google "sql injection" see more

Marimuthu Arigovindasamy16y ago
If you are getting "Invalid username or password" exception means, it's a problem with your ConnectionString.

Please check your username, password and server details in connectionstring.

and also, there is a syntax error in the query.

SqlCommand cmd = new SqlCommand("select * from Usersprogrammer where UserName='" + txtusername.Text + "' Or Password='"+txtpassword.Text+"'", con);
0