Multi user form C# NOT linking next form

Question

1.00/5 (2 votes)

See more:

I'm having a huge problem. Whenever I click 'LOGIN' and enter the information from SQL it does NOTHING, however when if I enter incorrect credentials (username and password) I get an error.

Code:

private void button1_Click(object sender, EventArgs e)
{
    SqlConnection sqlco =
        new SqlConnection(
            @"Data Source=(LocalDB)\MSSQLLocalDB;AttachDbFilename=C:\Users\plumz\OneDrive\Documents\Programming Project 2021\PROGRAM\Database\Gym_Management_DB.mdf;Integrated Security=True;Connect Timeout=30");
    SqlCommand cmd =
        new SqlCommand(
            "SELECT * FROM log_data WHERE username = '" + username.Text.Trim() + "' AND password = '" +
            password.Text.Trim() + "' ", sqlco);
    SqlDataAdapter sda = new SqlDataAdapter(cmd);
    var dt = new DataTable();
    sda.Fill(dt);
    string usertype = user_type.SelectedItem.ToString();
    if (dt.Rows.Count > 0)
    {
        for (var i = 0; i < dt.Rows.Count; i++) //state rows in table
        {
            if (dt.Rows[i]["usertype"].ToString() == usertype)
            {
                MessageBox.Show("You are logged in as " + dt.Rows[i][2]);
                switch (user_type.SelectedIndex)

                {
                    case 0:
                    {
                        customer customer1 = new customer();
                        customer1.Show();
                        this.Hide();
                        break;
                    }

                    case 1:
                    {
                        Staff staff1 = new Staff();
                        staff1.Show();
                        this.Hide();
                        break;
                    }

                    case 2:
                    {
                        Trainer trainer1 = new Trainer();
                        trainer1.Show();
                        this.Hide();
                        break;
                    }
                    default:
                        MessageBox.Show("wah gwan");
                        break;
                } // end nested switch
            } //end check for user type
        }
    } // end row count
    else
    {
        MessageBox.Show("The username or password is incorrect,Try Again");
    }
} // end button LOG IN CLICK

What I have tried:

I tried debugging to watch the values and it seem pretty fine

Posted 1-Dec-21 8:47am

Judel Dobbs

Updated 1-Dec-21 17:31pm

BillWoodruff

v3

Add a Solution

Comments

Judel Dobbs 1-Dec-21 15:27pm

private void button1_Click(object sender, EventArgs e)
{

SqlConnection sqlco = new SqlConnection(@"Data Source=(LocalDB)\MSSQLLocalDB;AttachDbFilename=C:\Users\plumz\OneDrive\Documents\Programming Project 2021\PROGRAM\Database\Gym_Management_DB.mdf;Integrated Security=True;Connect Timeout=30");
SqlCommand cmd = new SqlCommand("SELECT * FROM log_data WHERE username = '" + username.Text.Trim() + "' AND password = '" + password.Text.Trim() + "' ", sqlco);
SqlDataAdapter sda = new SqlDataAdapter(cmd);
DataTable dt = new DataTable();
sda.Fill(dt);
string usertype = user_type.SelectedItem.ToString();
if (dt.Rows.Count > 0)
{

for (int i = 0; i < dt.Rows.Count; i++)//state rows in table
{
if (dt.Rows[i]["usertype"].ToString() == usertype)
{
MessageBox.Show("You are logged in as " + dt.Rows[i][2]);
switch (user_type.SelectedIndex)

{
case 0:
{
customer customer1 = new customer();
customer1.Show();
this.Hide();
break;
}

case 1:
{
Staff staff1 = new Staff();
staff1.Show();
this.Hide();
break;
}

case 2:
{
Trainer trainer1 = new Trainer();
trainer1.Show();
this.Hide();
break;
}
default:
MessageBox.Show("wah gwan");
break;
} // end nested switch

} //end check for user type

}// end for loop
}// end row count
else

{
MessageBox.Show("The username or password is incorrect,Try Again");
}

} // end button LOG IN CLICK

Richard Deeming 2-Dec-21 3:53am

Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation to build a SQL query. ALWAYS use a parameterized query.

Everything you wanted to know about SQL injection (but were afraid to ask) | Troy Hunt[^]
How can I explain SQL injection without technical jargon? | Information Security Stack Exchange[^]
Query Parameterization Cheat Sheet | OWASP[^]

Richard Deeming 2-Dec-21 3:54am

You are storing passwords in plain text. Don't do that.

Secure Password Authentication Explained Simply[^]
Salted Password Hashing - Doing it Right[^]

2 solutions

Add a Solution

Add your solution here

Treat my content as plain text, not as HTML

Preview 0

…

Existing Members

Sign in to your account

...or Join us

Download, Vote, Comment, Publish.

Your Email
Password
Forgot your password?

Your Email
This email is in use. Do you need your password?
Optional Password

I have read and agree to the Terms of Service and Privacy Policy
Please subscribe me to the CodeProject newsletters

When answering a question please:

Read the question carefully.
Understand that English isn't everyone's first language so be lenient of bad spelling and grammar.
If a question is poorly phrased then either ask for clarification, ignore it, or edit the question and fix the problem. Insults are not welcome.
Don't tell someone to read the manual. Chances are they have and don't get it. Provide an answer or move on to the next question.

Let's work to help developers, not make them feel stupid.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)

OriginalGriff · Answer 1 · 2021-12-01T09:19:00

We can't tell: we have no access to your code, or any idea what you are doing to try and process a login.
And that's kinda important as we can't help at all without the code, and probably access to the data it is working to (as bad data can cause all sorts of problems).

So it going to be up to you and the debugger - just "it seem pretty fine" isn't good enough: what is it retrieving, what are you comparing it to, what is the code doing when you run it?
Only you can find that out, only you can even look at it.

So, break out the debugger, start adding breakpoints and single stepping - it's pretty much the only way you will be able to collect enough information to have any idea what is going wrong.

BillWoodruff · Answer 2 · 2021-12-01T17:22:00

Solution 2

I reformatted your code, and added it to your question.

Put a breakpoint before this line:

string usertype = user_type.SelectedItem.ToString();

and examine the state/values of 'dt and 'sda; then, single-step (F11) through the for-loop to see where "what you expect" does not happen.

Posted 1-Dec-21 17:22pm