MySQL Password Login Code?

Question

I'm trying to do a Login code in C# with MySQL. Basically the user enters a username and password then the code checks the database if the the password is correct. I'm having trouble getting the code to read from the data base... Here is where I'm at.

public string strUsername;
public string strPassword;


//Connect to DataBase
MySQLServer.Open();

//Check Login
MySqlDataReader mySQLReader = null;
MySqlCommand mySQLCommand = MySQLServer.CreateCommand();
mySQLCommand.CommandText = ("SELECT * FROM user_accounts WHERE username =" +strUsername);
mySQLReader = mySQLCommand.ExecuteReader();
while (mySQLReader.Read())
{
  string TruePass = mySQLReader.GetString(1);
  if (strPassword == TruePass)
  {
    blnCorrect = true;
    //Get Player Data
  }
}

MySQLServer.Close();

From what I've done in the past, I thought this would work but if I print it, it Seems like its not being read. I am still fairly new to MySQL so any help would be Great.

What does the debugger tell you?

Tieson T.
– Tieson T.

2011-12-06 06:36:45 +00:00
Commented Dec 6, 2011 at 6:36 — Tieson T.
– Tieson T., Commented Dec 6, 2011 at 6:36
Look here: xkcd.com/327

albertjan
– albertjan

2011-12-06 11:15:01 +00:00
Commented Dec 6, 2011 at 11:15 — albertjan
– albertjan, Commented Dec 6, 2011 at 11:15

KV Prajapati · Accepted Answer · 2011-12-06 06:47:06Z

3

Non-numeric field value must be enclosed with single quote.

mySQLCommand.CommandText = "SELECT * FROM user_accounts WHERE username ='" +strUsername + "'";
mySQLCommand.Connection=MySQLServer;

but you have to use Parameters to prevent SQL Injection.

 mySQLCommand.CommandText = "SELECT * FROM user_accounts WHERE username =@username"; 
 mySQLCommand.Connection=MySQLServer;
 mySQLCommand.Parameters.AddWithValue("@username",strUsername);

edited Dec 6, 2011 at 6:47

answered Dec 6, 2011 at 6:36

KV Prajapati

94.8k20 gold badges151 silver badges188 bronze badges

Sign up to request clarification or add additional context in comments.

2 Comments

competent_tech Over a year ago

Should also advise OP to not hard-code ordinal position of password in GetString(1) unless select statement specifies such.

Dusty Over a year ago

Thank you ill give it a try. I'll let you know if i have anymore problems.

m.qayyum · Accepted Answer · 2011-12-06 06:56:08Z

-2

        string con_string = @"Data Source=.\SQLEXPRESS;AttachDbFilename=C:\Database.mdf;Integrated Security=True;User Instance=True";
        string query = "SELECT * FROM Users WHERE UseName='" + txtUserName.Text.ToString() + "' AND Password='" + txtPassword.Text + "'";
        SqlConnection Con = new SqlConnection(con_string);
        SqlCommand Com = new SqlCommand(query, Con);
        Con.Open();
        SqlDataReader Reader;
        Reader = Com.ExecuteReader();

        if (Reader.Read())
        {
            lblStatus.Text="Successfully Login";
        }
        else
        {
           lblStatus.Text="UserName or Password error";
        }
        Con.Close();

As AVD said you should use parameters to prevent sql injection....

answered Dec 6, 2011 at 6:56

m.qayyum

4112 gold badges18 silver badges44 bronze badges

2 Comments

albertjan Over a year ago

show how to use parameters is you say the OP should do it. Ans why compare strings on the DB is stead of in code.

m.qayyum Over a year ago

where i have said that it will prevent from sql injection. I have just shown how to validate login...read my last line...

Collectives™ on Stack Overflow

MySQL Password Login Code?

2 Answers 2

2 Comments

2 Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

2 Comments

2 Comments

Your Answer

Sign up or log in

Post as a guest

Related