c# compare input to mysql value

Question

I wanted to create a function on which a user can guess the value from a MySQL database. label2 is randomly generated by other codes, so the user will have to guess the partner value of the label2 by inputting texbox1. I try to use the usual login function for the code

 s = "SELECT val2 FROM data_reader.db WHERE val1='" + this.label2.Text + "'and image='" + this.textBox1.Text + "';";
                int count = 0;

            while (mdr.Read())
            {
                count = count + 1;
            }
            if (count == 1)
            {
                MessageBox.Show("correct");
            }
            else
            {
                MessageBox.Show("wrong");
            }

problem with this code is it always return wrong even when the value are correct. is there any missing algorithm or maybe my code is not suitable for this purpose?

Maybe use if (count >= 1) instead of ==? Why are you counting if you expect there to be only one answer? Or can there be multiple rows with the same val1 and image values? — Ron Beyer
– Ron Beyer, Commented May 7, 2015 at 12:30
Please don't concatenate strings to form an SQL query. You are extremely open to SQL Injection attacks with this approach. en.wikipedia.org/wiki/SQL_injection — irreal
– irreal, Commented May 7, 2015 at 12:34

ryanyuyu · Accepted Answer · 2015-05-07 12:53:55Z

2

You forgot insert a space character between the label2.Text value and the AND junction.

s = "SELECT val2 FROM data_reader.db WHERE val1='" + this.label2.Text 
    + "' AND image='" + this.textBox1.Text + "';";

edited May 7, 2015 at 12:53

ryanyuyu

6,50611 gold badges53 silver badges56 bronze badges

answered May 7, 2015 at 12:39

Zdenda Zbranek

212 bronze badges

Sign up to request clarification or add additional context in comments.

1 Comment

jenan Over a year ago

hi, i think there something wrong with my mysql query, I have a database which is data_reader.db, I wanted to find the value of image(char not filepath). val1 have been randomly generated so i have to guess the image value...any idea? –

Phiter · Accepted Answer · 2015-05-07 12:37:52Z

0

Ok i'll help you with something else here

First: Lesson i learned here, never use " + ", you should use AddWithValue on the query parameters, something like this:

cmd.CommandText = "SELECT val2 FROM data_reader.db WHERE val1 = @value1 and image=@image";
cmd.Parameters.Clear();
cmd.Parameters.AddWithValue("@value1", this.label2.Text);
cmd.Parameters.AddWithValue("@image", this.textBox1.Text);

It is easier to understand and more secure.

Second: You just need to use

if (mdr.Read())
{
    MessageBox.Show("Correct!");
}
else
{
    MessageBox.Show("Wrong!");
}

edited May 7, 2015 at 12:37

answered May 7, 2015 at 12:34

Phiter

15k14 gold badges52 silver badges87 bronze badges

1 Comment

jenan Over a year ago

hi, i think there something wrong with my mysql query, I have a database which is data_reader.db, I wanted to find the value of image(char not filepath). val1 have been randomly generated so i have to guess the image value...any idea?

Collectives™ on Stack Overflow

c# compare input to mysql value

2 Answers 2

1 Comment

1 Comment

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

1 Comment

1 Comment

Your Answer

Sign up or log in

Post as a guest

Related