Login Authentication in vb.net

[krisssgopi]

Hi Team,

Below code is working fine. Main thing is if i entered wrong username and password it was not displaying message MsgBox("invalid username or password"). please help ow to validate it using sql. what is going wrong. thanks in advance.

Private Sub Button1_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles Button1.Click
        Try
            con.Open()
            cmd.CommandType = CommandType.Text
            cmd.CommandText = "select * from login where username in('" & TextBox1.Text & "')and password='" & TextBox2.Text & "'"
            da = New SqlDataAdapter(cmd.CommandText, con)
            da.Fill(ds, "login")
            maxcount = ds.Tables(0).Rows.Count - 1
            Dim a(maxcount), b(maxcount) As String
                        For i = 0 To maxcount
                a(i) = ds.Tables("login").Rows(i).Item(0)
                b(i) = ds.Tables("login").Rows(i).Item(1)
                If a(i) = TextBox1.Text And b(i) = TextBox2.Text Then
                    Me.Hide()
                    Form2.Show()
                Else
                    MsgBox("invalid username or password")
                End If
 
            Next
 
        Catch ex As Exception
            MsgBox(ex.Message.ToString)
        End Try
        con.Close()
    End Sub

[Monomachus]

@krisssgopi
Hi,
First of all don't ever build a query this way, it can cause users cracking your application using SQL injection. Instead use SqlParameter. Take a look at this lesson Lesson 06: Adding Parameters to Commands.

2. I don't think your sql request is right "username in('" + TextBox1.Text + "')". If you want to login, I think you should change it to username = '" + TextBox1.Text + "'. Sorry databases is not my strongest side.

3. I don't really understand what are you trying to do.
Please explain.

maxcount = ds.Tables(0).Rows.Count - 1
Dim a(maxcount), b(maxcount) As String
For i = 0 To maxcount
a(i) = ds.Tables("login").Rows(i).Item(0)
b(i) = ds.Tables("login").Rows(i).Item(1)
 

P.S. You still don't use code button. Please use code button(#) or tags to insert the code. Thanks in advance

[krisssgopi]

@Monomachus
Hi Buddy,
1.) select * from student where username in('gopi') we can query like this way also na.
2.)What i am trying is... getting the username and password in textbox. comparing those thing in database if it is correct it should show me form2 otherwise i has to display me the message.
3.)
For i = 0 To maxcount
a(i) = ds.Tables("login").Rows(i).Item(0)
b(i) = ds.Tables("login").Rows(i).Item(1)
If a(i) = TextBox1.Text And b(i) = TextBox2.Text Then
Me.Hide()
Form2.Show()
Else
MsgBox("invalid username or password")
End If

i am making the loop this array will hold the record of username and password. this will check with the value entered by user in textbox 1 and 2.

Please help me...give me idea to develope this application.

[Monomachus]

@krisssgopi
You don't need all these. All you need is just execute SQL
"select * from login where username = '" & txtUsername.Text & "' and password='" & txtPassword.Text &"'.
And than if select returns something (it only can be your user), than you have a user with such a username & password. If not when you show the messagebox ("invalid username or password").

P.S. I'm not gonna help you if you don't read the links that I give you.

[tlhintoq]

TIP: When you first created your question you were asked to wrap your code with [code] tags.

It really does help a bunch. Look how much easier it is to read now that someone has done it for you. Its the button with a '#' on it.

More on tags. They're cool. Check'em out.