SQL Login HELP

[ignnniter]

Having a problem setting up a login form for my project,

here's the code:

Imports System
Imports System.Data.SqlClient


Public Class Login
    Dim con As SqlConnection
    Dim cmd As SqlCommand
    Dim rd As SqlDataReader

    Private Sub dataopen()
        con.ConnectionString = "Server=IGNITER-PC\OBEXPRESS;Database=EMS;User ID=sa;Password=au"
        con.Open()
    End Sub

    Private Sub EmsStickyButton1_Click(sender As Object, e As EventArgs) Handles EmsStickyButton1.Click
        dataopen()
        cmd.Connection = con
        cmd.CommandText = "Select User_Name, userpass from Borrower where sername='" & EmsTextBox1.Text & "' AND password = '" & EmsTextBox2.Text & "'"
        rd = cmd.ExecuteReader
        If rd.HasRows Then
            MsgBox("SUCCESS")
        Else
            MsgBox("wrong")
        End If

    End Sub
End Class

It just throwing me :
A first chance exception of type 'System.NullReferenceException' occurred in EMS.exe
An unhandled exception of type 'System.NullReferenceException' occurred in EMS.exe
Additional information: Object reference not set to an instance of an object.

Please help me thanks!

[cgeier]

Adding "New" should fix your issue:

From:

Dim con As SqlConnection
Dim cmd As SqlCommand

To:

Dim con As New SqlConnection
Dim cmd As New SqlCommand

You should consider using a Using statement:

The scope of your variables should only be as big as
necessary. Also, use parameterized queries to avoid SQL injection.

I would consider changing your code as follows:

Imports System
Imports System.Data.SqlClient


Public Class Login

    Dim connString As String = "Server=IGNITER-PC\OBEXPRESS;Database=EMS;User ID=sa;Password=au"

    Private Sub readDB(ByVal username As String, ByVal userpassword As String)


        Using con As New SqlConnection
            con.ConnectionString = connString
            con.Open()

            Using cmd As New SqlCommand

                Dim rd As SqlDataReader
                Dim dbUsername As String
                Dim dbUserpassword As String

                Try
                    cmd.Connection = con
                    cmd.CommandText = "Select User_Name, userpass from Borrower where username= @username AND password = @userpassword"

                    cmd.Parameters.AddWithValue("@username", username)
                    cmd.Parameters.AddWithValue("@userpassword", userpassword)

                    rd = cmd.ExecuteReader
                    If rd.HasRows Then

                        'read row-by-row
                        Do While rd.Read
                            'get row data for username
                            dbUsername = rd("username").ToString()

                            'get row data for userpassword
                            dbUserpassword = rd("userpassword").ToString()
                        Loop

                        MsgBox("SUCCESS")
                    Else
                        MsgBox("wrong")
                    End If

                    'close the reader
                    rd.Close()

                Catch ex As SqlException
                    Console.WriteLine(ex.Message)
                    MessageBox.Show(ex.Message, "Error", MessageBoxButtons.OK, MessageBoxIcon.Error)

                Catch ex As Exception
                    Console.WriteLine(ex.Message)
                    MessageBox.Show(ex.Message, "Error", MessageBoxButtons.OK, MessageBoxIcon.Error)
                End Try

            End Using 'SqlCommand
        End Using 'SqlConnection

    End Sub

    Private Sub EmsStickyButton1_Click(sender As Object, e As EventArgs) Handles EmsStickyButton1.Click

        readDB(EmsTextBox1.Text, EmsTextBox2.Text)

    End Sub


End Class

[ignnniter]

Thanks, that worked.
Yeah but i will not release it, this is just a school project.

[cgeier]

I added another Try-Catch in this version:

    Private Sub readDB(ByVal username As String, ByVal userpassword As String)


        Using con As New SqlConnection
            con.ConnectionString = connString


            Try
                con.Open()

                Using cmd As New SqlCommand

                    Dim rd As SqlDataReader
                    Dim dbUsername As String
                    Dim dbUserpassword As String

                    Try
                        cmd.Connection = con
                        cmd.CommandText = "Select User_Name, userpass from Borrower where username= @username AND password = @userpassword"

                        cmd.Parameters.AddWithValue("@username", username)
                        cmd.Parameters.AddWithValue("@userpassword", userpassword)

                        rd = cmd.ExecuteReader
                        If rd.HasRows Then

                            'read row-by-row
                            Do While rd.Read
                                'get row data for username
                                dbUsername = rd("username").ToString()

                                'get row data for userpassword
                                dbUserpassword = rd("userpassword").ToString()
                            Loop

                            MsgBox("SUCCESS")
                        Else
                            MsgBox("wrong")
                        End If

                        'close the reader
                        rd.Close()

                    Catch ex As SqlException
                        Console.WriteLine(ex.Message)
                        MessageBox.Show(ex.Message, "Error", MessageBoxButtons.OK, MessageBoxIcon.Error)

                    Catch ex As Exception
                        Console.WriteLine(ex.Message)
                        MessageBox.Show(ex.Message, "Error", MessageBoxButtons.OK, MessageBoxIcon.Error)
                    End Try

                End Using 'SqlCommand

            Catch ex As SqlException
                Console.WriteLine(ex.Message)
                MessageBox.Show(ex.Message, "Error", MessageBoxButtons.OK, MessageBoxIcon.Error)
            Catch ex As Exception
                Console.WriteLine(ex.Message)
                MessageBox.Show(ex.Message, "Error", MessageBoxButtons.OK, MessageBoxIcon.Error)
            End Try
        End Using 'SqlConnection

    End Sub