Login form with access database

Question

try
{

    OleDbConnection con = new OleDbConnection(@"Provider=Microsoft.Jet.OLEDB.4.0;Data Source=  C:\Users\jay.desai\Documents\Visual Studio 2008\Projects\Jahoo Sign in form!\Jahoo Sign in form!\Registration_form.mdb");
    con.Open();
    OleDbCommand cmd = new OleDbCommand("select * from Login where Username='"+txtlognUsrnm.Text+"' and Password='"+txtlognpswrd+"'", con);
    OleDbDataReader dr = cmd.ExecuteReader();
    if(dr.Read() == true)
    {
        MessageBox.Show("Login Successful");
    }
    else
    {
        MessageBox.Show("Invalid Credentials, Please Re-Enter");
    }
catch (Exception ex)
{
    MessageBox.Show(ex.ToString());
}

I have created one login form and one table in microsoft access which contains username and password fields.when i click on login button it always shows else message though the username and password is same as in table.

Perhaps actually passing in the password in your query string? txtlognpswrd should be txtlognpswrd.Text. HOWEVER - please learn and use Parameterized queries to prevent SQL Injection attacks. — Tim
– Tim, Commented Jun 22, 2013 at 10:42

Steve · Accepted Answer · 2013-06-22 10:50:48Z

3

The word PASSWORD is a reserved keyword in access-jet. You need to encapsulate it in square brackets.

OleDbCommand cmd = new OleDbCommand("select * from Login where Username=" + 
                       "? and [Password]=?", con);

Also do not use string concatenation to build sql commands but a parameterized query

There are other problems in your code above.
First try to use the using statement to be sure that the connection and other disposable objects are correctly closed and disposed.
Second, if you need only to check the login credentials, then there is no need to get back the Whole record and you could use the ExecuteScalar method avoiding the OleDbDataReader object

string constring = @"Provider=Microsoft.Jet.OLEDB.4.0;Data Source=  C:\Users\jay.desai\Documents\Visual Studio 2008\Projects\Jahoo Sign in form!\Jahoo Sign in form!\Registration_form.mdb";
string cmdText = "select Count(*) from Login where Username=? and [Password]=?"
using(OleDbConnection con = new OleDbConnection(constring))
using(OleDbCommand cmd = new OleDbCommand(cmdText, con))
{
     con.Open();
     cmd.Parameters.AddWithValue("@p1", txtlognUsrnm.Text);
     cmd.Parameters.AddWithValue("@p2", txtlognpswrd.Text);  // <- is this a variable or a textbox?
     int result = (int)cmd.ExecuteScalar()
     if(result > 0)
          MessageBox.Show("Login Successful");
     else
         MessageBox.Show("Invalid Credentials, Please Re-Enter");
}

edited Jun 22, 2013 at 10:50

answered Jun 22, 2013 at 10:44

Steve

217k22 gold badges242 silver badges296 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

Jay Desai Over a year ago

thank u...it was my mistake i forgot to write Text after txtLognpswrd..and yeah parameterized query is also great concept...thanks again

Collectives™ on Stack Overflow

Login form with access database

1 Answer 1

1 Comment

Your Answer

Linked

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

1 Comment

Your Answer

Sign up or log in

Post as a guest

Linked

Related