Username & pwd verification ?

SUNIL GUTTA

Is there any way out to verify username and password using sql query to DB ..

Well actually i pre-requisite is i have say many columns i,e password and usernames ... so on

I used query like this

cmd = new SqlCommand("select username,password from studentform where username = " '+textbox1.text' and password= " '+textbox2.text ' " ,con);

con.Open();

SqlDataReader dr = cmd.ExecuteReader();

if (dr.Read())

{

Server.Transfer("studentafterlogin.aspx");

}

else

{

Response.Write("");

}

In above in my command , The select statement NOT WORKING PROPERLY i am not getting anything to datareader EVEN i given correct credentials ?? Problem in query ??

Help it please ....

4 Replies

Know the answer? Post it — somebody with the same question will find it here.

Vulpes13y ago
Accepted answer
The query doesn't look quite right. Try this:

cmd = new SqlCommand("select username,password from studentform where username = '" +TextBox1.Text + "' and password= '" +TextBox2.Text + "'" ,con);
SUNIL GUTTA13y ago
Yes that's a gem of an explanation :) Ty and have a nice day .. If there is any free time scheduled for u please can you refer my previous post regarding some ample work on MASTER PAGE .. ..

Just suggest in that case master page is advisable or not
Vulpes13y ago
Well, as you know, strings have to be enclosed in single quotes in SQL queries.

When the string to be inserted in the query is a C# variable (such as TextBox1.Text) the contents of the variable need to be surrounded by single quotes. As these single quotes aren't usually embedded in the variable itself, they have to be included in the strings either side of the variable to which it is being concatenated.

You can do this by trying to visualize how the query will eventually look as we've done above which is obviously quite error prone.

However, there are two alternative ways of doing it which make life a little easier.

The best way is to always use parameters rather than variables or hard-coded strings. As well as guarding against SQL injection, you don't need to worry whether what's inserted needs to be surrounded by single quotes or not with this approach.

The other way is to use the String.Format method which makes the final string easier to visualize. If we'd done that above, we'd have used:

cmd = new SqlCommand(String.Format("select username,password from studentform where username = '{0}' and password='{1}'", TextBox1.Text, TextBox2.Text) ,con);
SUNIL GUTTA13y ago
cheers thanks mate :) its been very helpful

Word of advice please : how to make these ' & '' work correctly as you made in above query ..

When to start with single ( ' ) and fallowed by ( " ) ..

Thank you