Click here to Skip to main content
15,881,898 members
Please Sign up or sign in to vote.
1.00/5 (3 votes)
See more:
string uname, pwd, pri, employee_id;
uname = txtUsername.Text;
pwd = txtPassword.Password;
pri = cmboSelectUser.Text;
employee_id = "";
DataSet ds = Globalvariables.Globals.select("select username,password,privilege,usertype,employee_id from add_user where username ='"+ uname + "' and password = '"+pwd+"'");
if (ds != null && ds.Tables[0].Rows.Count > 0)
{

}

What I have tried:

string uname, pwd, pri, employee_id;
                uname = txtUsername.Text;
                pwd = txtPassword.Password;
                pri = cmboSelectUser.Text;
                employee_id = "";
                DataSet ds = Globalvariables.Globals.select("select username,password,privilege,usertype,employee_id from add_user where username ='"+ uname + "' and password = '"+pwd+"'");
                if (ds != null && ds.Tables[0].Rows.Count > 0)
                {
}
Posted
Comments
Richard Deeming 20-Oct-22 4:24am    
Your code is vulnerable to SQL Injection[^]. NEVER use string concatenation/interpolation to build a SQL query. ALWAYS use a parameterized query.
Richard Deeming 20-Oct-22 4:25am    
You're storing your users' passwords in plain text. Don't do that!
Secure Password Authentication Explained Simply[^]
Richard Deeming 20-Oct-22 4:25am    
Beyond those obvious critical security errors, you haven't actually asked a question.

This content, along with any associated source code and files, is licensed under The Code Project Open License (CPOL)



CodeProject, 20 Bay Street, 11th Floor Toronto, Ontario, Canada M5J 2N8 +1 (416) 849-8900