-2

I've been stock in this problem:

enter image description here

Imports System.ComponentModel
Imports System.Data.SqlClient

Public Class Form1
    Dim MyConnection As SqlConnection = New SqlConnection("Server=DESKTOP-I0N45MV\SQL2012;Database=user;uid=;pwd=")
    Dim MyDataAdapter As New SqlDataAdapter()
    Dim MyDataAdapter1 As New SqlDataAdapter()
    Dim Result As String
    Dim Result1 As String

    Private Sub login_Click(sender As Object, e As EventArgs) Handles login.Click
        MyDataAdapter.SelectCommand = New SqlCommand()
        MyDataAdapter1.SelectCommand = New SqlCommand()

        MyDataAdapter.SelectCommand.Connection = MyConnection
        MyDataAdapter1.SelectCommand.Connection = MyConnection
        MyDataAdapter.SelectCommand.CommandText = "Select Username From users WHERE Username ='" & user_.Text & "'"
        MyDataAdapter1.SelectCommand.CommandText = "Select Password From users WHERE Password ='" & pass_.Text & "'"
        MyConnection.Open()
        Result = MyDataAdapter.SelectCommand.ExecuteScalar()
        Result1 = MyDataAdapter1.SelectCommand.ExecuteScalar()
        MyConnection.Close()
Arulkumar
  • 12,966
  • 14
  • 47
  • 68
hotchongas
  • 35
  • 3

1 Answers1

0

Firstly do not ever use this:
MyDataAdapter.SelectCommand.CommandText = "SELECT Username FROM users WHERE Username ='" & user_.Text & "'" since it will let your code be injectable by SQL injection, use a stored procedure or parameterized queries instead.

Secondly I don't understand why you would use two queries.
Can't you do it with just one like SELECT Username FROM users WHERE Username = 'foo' AND Password = 'bar' and then just use the result of this query?

Thirdly I would recommend that you pass the connection string as a parameter to your project. If you are coding a WinForms project, you can access it like this : Dim connection As New SqlConnection(My.Settings.connectionString)

And lastly since that's what you asked, your connection string should look like Server=YourServerName;Database=YourDBName;Trusted_Connection=True;.
If you use Windows Authentication on your SQL Server, it should look remotely like this Server=myServerAddress;Database=myDataBase;User Id=myUsername; Password=myPassword;, if you are using username and password to authenticate.

Community
  • 1
  • 1
sapi
  • 244
  • 1
  • 9
  • @hotchongas If that answer helped you with your problem either upvote (arrow up) or accept (check) it. – jAC Sep 19 '16 at 07:06