3

Here is my code.. I'm trying to get it to validate against the database.

pass/user = Admin

{
/// <summary>
/// Interaction logic for MainWindow.xaml
/// </summary>
public partial class MainWindow : Window
{
    public MainWindow()
    {
        InitializeComponent();
    }

    private void main_B_Signup_Click(object sender, RoutedEventArgs e)
    {
        RegWindow rWindow = new RegWindow();
        rWindow.Show();
        this.Close();
    }

    private void main_B_login_Click(object sender, RoutedEventArgs e)
    {
        //connect to the database
        SqlConnection loginConn = new SqlConnection("server=localhost;"+ "Trusted_Connection=yes;" + "database=Production; " + "connection timeout=30");

        SqlCommand cmd = new SqlCommand("Select *from User where Username=' " + this.Main_T_Username.Text + " ' and Password=' " + this.Main_T_Password.Text + " ' ;", loginConn);
        //SqlCommand cmd = new SqlCommand("Select *from User where Username='@Username' and Password='@Password';", loginConn);
        //cmd.Parameters.Add(new SqlParameter("Username", this.Main_T_Username.Text));
        //cmd.Parameters.Add(new SqlParameter("Password", this.Main_T_Password.Text));

        loginConn.Open();
        SqlDataReader rdr = cmd.ExecuteReader();
        string username = null;

            if (rdr.HasRows)
            {
                while (rdr.Read())
                {
                    username = rdr["Username"].ToString();
                }

                loginConn.Close();

                MessageBox.Show("Well done!");

            }
            else
            {
                MessageBox.Show("WrongPass!");
                loginConn.Close();
            }

        }
    }
}

but the error I get is

Incorrect syntax near the keyword 'User'

But the table is called User and there are columns Username and Password

Pic Of Database

Improve this question
6
  • 1
    Put an empty space between * and from, like Select * from User Commented Apr 25, 2016 at 13:50
  • I have tried that. still gives me the same error Commented Apr 25, 2016 at 13:51
  • Check David's answer Commented Apr 25, 2016 at 13:52
  • I suggestion you do not add user parameter in sql text, use C# addWidthValue parameter. Because your method allow to SQL INJECTION attack problem. msdn.microsoft.com/tr-tr/library/… Commented Apr 25, 2016 at 13:54
  • 1
    @rootturk I have been reading about SQL INJECTION issues but ill admit I don't understand yet. but thank you. Commented Apr 25, 2016 at 13:59

3 Answers 3

Reset to default
7

"User" is a reserved word in SQL Server. To use it as an identifier for a schema object, surround it with square braces:

SELECT * FROM [User]

It's generally good practice to do this with schema object identifiers anyway. It makes them more explicit in the query.

Additionally, you are:

  • directly concatenating user input as executable code, which is a SQL injection vulnerability. Use query parameters instead.
  • storing user passwords as plain text, which is grossly irresponsible to your users. User passwords should be obscured with a one-way hash and should never be retrievable.
Improve this answer
Sign up to request clarification or add additional context in comments.

7 Comments

I do get that, I'm just trying to get the basics down and I'm teaching myself as i go along.. once the program works.. I will try the security parts.
@AlexK. How would you rewrite it so it is not disposing the command/connection?
Wrap the connection and command instantiation in a using (...) {} statement; that will take care of it for you.
are you talking about using System.Windows.Media; or using System.Data.Sql;?
I mean the using statement: msdn.microsoft.com/en-GB/library/yh598w02.aspx
|
0

Put the word User in square brackets like [User] because it's a defined keyword in SQL.

Improve this answer

Comments

0

Some words are protected

try

Select * from [User] where Username.....
Improve this answer

Comments

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.