Member Avatar for hyperion0

So, I created a program in VB.Net with Windows Form and I want the user to be able to create a new user, limited to 5 user accounts only. I also want to know if it's possible to change password and delete user accounts.

Can I make it so that each User has their own MS Access database? For example, User 1 can only access Database1 but not Database2. And User 2 can only access Database2 but not Database1.

Here is the log-in form that I created that can only have one user account:

Public Class Form3
    Private Sub Register_Click(sender As Object, e As EventArgs) Handles Register.Click
        Try
            My.Settings.Name = NameTxt.Text
            My.Settings.Username = Username.Text
            My.Settings.Password = Password.Text
            My.Settings.Avatar = OpenFileDialog1.FileName
            My.Settings.status = True
            My.Settings.Save()
            MsgBox("Your account was successfully created.", MsgBoxStyle.Information)
        Catch ex As Exception
            MsgBox("Account failed to register.", MsgBoxStyle.Critical)
        End Try
    End Sub

    Private Sub LinkLabel1_LinkClicked(sender As Object, e As LinkLabelLinkClickedEventArgs) Handles LinkLabel1.LinkClicked
        Try
            OpenFileDialog1.Title = "Add Picture"
            OpenFileDialog1.FileName = ".png"
            OpenFileDialog1.Filter = "All Files|*.*"
            OpenFileDialog1.ShowDialog()
            PictureBox1.Image = System.Drawing.Image.FromFile(OpenFileDialog1.FileName)
        Catch ex As Exception
            'Do nothing'
        End Try
    End Sub
End Class

Is it possible to do that using only Settings of the project? Or do I really need to use MySQL (as I've seen from youtube tutorials)? I am only a beginner with little knowledge about programming, so please bear with me if my questions seem silly.

  • 2 Contributors
  • 1 Reply
  • 514 Views
  • 27 Minutes Discussion Span
  • Latest Post Latest Post by rproffitt

Dani AI

Generated

As discovered, My.Settings is not a good place to keep multiple user accounts. Recommended approach: use a Users table in the Access file (or a server RDBMS later), store username, avatar path and a salted+hashed password, use parameterized OleDb commands, and enforce the "5 users" rule by checking the row count before insert. As noted, moving to SQL (server) is the better long-term path for security and concurrency, but Access is fine for simple local apps.

Suggested Users table (Access schema example):

CREATE TABLE Users (
  ID COUNTER PRIMARY KEY,
  Username TEXT(50),
  PasswordHash TEXT(200),
  PasswordSalt TEXT(50),
  AvatarPath TEXT(255),
  DbFile TEXT(255),    -- optional: path to a per-user .accdb
  CreatedAt DATETIME
);

Password handling (use PBKDF2; never store plaintext). Example VB.NET helpers:

Imports System.Security.Cryptography

Function CreatePasswordHash(password As String) As Tuple(Of String, String)
  Dim salt(15) As Byte
  Using rng As New RNGCryptoServiceProvider()
    rng.GetBytes(salt)
  End Using
  Using pbkdf As New Rfc2898DeriveBytes(password, salt, 10000)
    Dim hash = pbkdf.GetBytes(32)
    Return New Tuple(Of String, String)(Convert.ToBase64String(hash), Convert.ToBase64String(salt))
  End Using
End Function

Function VerifyPassword(storedHashB64 As String, storedSaltB64 As String, attempt As String) As Boolean
  Dim salt = Convert.FromBase64String(storedSaltB64)
  Using pbkdf As New Rfc2898DeriveBytes(attempt, salt, 10000)
    Return Convert.ToBase64String(pbkdf.GetBytes(32)) = storedHashB64
  End Using
End Function

Register / enforce 5-user limit (outline):

Using cn As New OleDbConnection(connString)
  cn.Open()
  ' count existing users
  Using chk As New OleDbCommand("SELECT COUNT(*) FROM Users", cn)
    If Convert.ToInt32(chk.ExecuteScalar()) >= 5 Then Throw New InvalidOperationException("Limit reached")
  End Using
  ' insert with parameterized command (use ? placeholders for OleDb)
  ' ...
End Using

Notes and cautions: Access is file-based — concurrency, backups and security are limited. Per-user .accdb files are possible (store path in Users.DbFile) but complicate maintenance; single DB + row-level logic is simpler. For production or sensitive data, migrate to a server DB and use tested authentication mechanisms. Watch the ACE/Jet provider bitness (x86 vs x64) when running OleDb.

Member Avatar for rproffitt

The answer to most if not all the questions is yes. I wish folk would number their questions and always end a question with a question mark so everyone can find the question and answer them by the numbers.

But I'm going to stop here and note that if the user can create the logins then there seems to be no reason to have any user security since this person created all 5 accounts. It's one really odd design and even odder to limit it to five. Hardcoding that limit may be adding complexity where leaving it to nearly unlimited might be better. That is, you do the usual please enter you account name then password and check if they are a current user and if so connect to their database.

And yes, SQL would be a great step up in learning the better methods and can push the security back into the database since leaving it in your app means the database is usually insecure.

As to being new, that wears off in time. Mostly by continuing classes and tutorials.

commented: Alright, thank you for informing me! +0
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.