Member Avatar for LearnVB2010

Here is my code:

Imports System.Data.SqlClient

Public Class Form1

    Dim iConnect As SqlConnection
    Dim iCmd As SqlCommand
    Dim iRdr As SqlDataReader

    Private Sub dologin()
        iConnect = New SqlConnection("Data Source=.\SQLEXPRESS;AttachDbFilename=|DataDirectory|\UserData.mdf;Integrated Security=True;User Instance=True")
        iConnect.Open()
        Dim strLogin As String = "SELECT username, password FROM tableusername WHERE username = '" & userbox.Text & "' AND password = '" & passbox.Text & "'"
        iCmd = New SqlCommand(strLogin, iConnect)
        iRdr = iCmd.ExecuteReader
        If iRdr.Read = True Then
            iRdr.Close()
            iConnect.Close()
            Dim absen As String = "INSERT INTO tanggal(date) values(getdate())"
            iCmd = New SqlCommand(absen, iConnect)
            iConnect.Open()
            iCmd.ExecuteNonQuery()
            MsgBox("Berhasil!")

        Else

            MsgBox("Gagal Maning")

        End If

    End Sub


    Private Sub absen_b_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles absen_b.Click
        dologin()
    End Sub
End Class

Is there anything wrong with it?

  • 3 Contributors
  • 4 Replies
  • 195 Views
  • 7 Hours Discussion Span
  • Latest Post Latest Post by debasisdas

Dani AI

Generated

Three quick, practical points that tie together comments from and and explain the invisible-insert symptom reported by : string-building for SQL leaves the code open to injection and parsing problems; a column named date invites confusion with SQL keywords; and local MDF files attached via the project often get copied to the output folder so runtime changes are written to a different file than the one inspected in Solution Explorer.

A compact, safer pattern (VB.NET) that fixes the biggest issues — parameterized statements, automatic disposal, and explicit timestamping — looks like this:

' parameterized, disposed pattern (VB.NET)
Dim connStr As String = "YourConnectionStringHere"
Dim uname = userbox.Text.Trim()
Dim pwd = passbox.Text

Using conn As New SqlConnection(connStr)
    conn.Open()
    Dim checkSql As String = "SELECT COUNT(1) FROM tableusername WHERE username=@user AND password=@pwd"
    Using chk As New SqlCommand(checkSql, conn)
        chk.Parameters.Add("@user", SqlDbType.NVarChar, 50).Value = uname
        chk.Parameters.Add("@pwd", SqlDbType.NVarChar, 50).Value = pwd
        Dim found As Integer = Convert.ToInt32(chk.ExecuteScalar())
        If found > 0 Then
            Dim insertSql As String = "INSERT INTO tanggal (AttendanceDate) VALUES (@ts)"
            Using ins As New SqlCommand(insertSql, conn)
                ins.Parameters.Add("@ts", SqlDbType.DateTime).Value = DateTime.Now
                ins.ExecuteNonQuery()
            End Using
            MessageBox.Show("Success")
        Else
            MessageBox.Show("Login failed")
        End If
    End Using
End Using

Extra notes and troubleshooting tips: prefer a non-keyword column name such as AttendanceDate (or wrap names in brackets). For consistent server timestamps, add a default constraint on the column in the database rather than relying on client time. If inserts appear to “disappear,” verify which MDF file the app actually uses (check the file’s Copy to Output Directory setting and the DataDirectory path) or connect with SSMS to the running instance. Always surface exceptions (Try/Catch + logging) while developing, and never store raw passwords — use a modern hash+salt approach.

These changes remove SQL injection risk, ensure resources are closed properly, and resolve the most common causes of invisible or missing rows.

Recommended Answers

All 4 Replies

Member Avatar for debasisdas

What happens when you execute the code ?

Are you getting any error ?

Member Avatar for LearnVB2010

What happens when you execute the code ?

Are you getting any error ?

that the weird part, there is nothing happen. it likes the code seceded and the message "Berhasil!" is poped out..

hm...

Member Avatar for hericles

There are a few things. For a start you are only closing the connection if iRdr is true. If the user name or password does not match the connection stays open. Thats wasteful.
Secondly, you're inserting the actual text entered into the user name and password text boxes into your SQL statement. That is REALLY bad as it leaves you open to SQL injection attacks. If I were to type 'steve or 1 = 1;' into the user name texbox, your sql statement becomes "SELECT username, password FROM tableusername WHERE username = steve or 1 = 1. The 1 = 1 is always true and so I log in without needing a user name or password. Thats bad enough but I can make things worse by using DELETE statements. If I manage to guess or discover a table name, say goodbye to your data. Use parametized queries to avoid that whole mess.
Hope that helps:)

Member Avatar for debasisdas

Also consider not to use date as a field name as a best practise. That is a predefined keyword in any database.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.