Login with different usertype Admin and Normal User

[Miurei]

I need help about this, I've been working for this a quiet while...
I want to log-in using one login form for both admin and normal user but after log in, some of its form and/or buttons in the form should not be available for normal users.
here is my code upon login:

    Private Sub ok_Click(sender As Object, e As EventArgs) Handles ok.Click
        Dim conn As New SqlConnection
        If TextBox1.Text = "" Or TextBox2.Text = "" Then
            MessageBox.Show("Please fill in all fields.", "Login Error", MessageBoxButtons.OK, MessageBoxIcon.Error)
        Else
           conn.ConnectionString = "Data Source=DOLE-PC\SQLEXPRESS;Initial Catalog=db_dole;Integrated Security=True;"
            Try
                Dim sql As String = "SELECT UName, Password, Usertype  FROM [db_dole].[dbo].[tbl_user] WHERE UName='" & TextBox1.Text & "' AND Password='" & TextBox2.Text & "'"
                Dim cmd As New SqlCommand(sql, conn)

                cmd.Connection = conn
                conn.Open()

                Dim dr As SqlDataReader = cmd.ExecuteReader

                If dr.Read = True Then
                    If sql = "SELECT Usertype FROM [db_dole].[dbo].[tbl_user] WHERE Usertype = 'Admin'" Then
                        Me.Hide()
                        MessageBox.Show("      W E L C O M E !")
                        mainform.Show()

                    ElseIf dr.Read = True Then
                        sql = "SELECT Usertype FROM [db_dole].[dbo].[tbl_user] WHERE Usertype = 'Normal'"
                        Me.Hide()
                        MessageBox.Show("      W E L C O M E !")
                        viewform.Show()
                        viewform.edit.Visible = False
                        viewform.Summary.Visible = False
                        viewform.NewRec.Visible = False
                        viewform.RFresh.Visible = False
                    End If
                Else
                    MessageBox.Show("Incorrect Username or Password.", "Login Failed", MessageBoxButtons.OK, MessageBoxIcon.Exclamation)
                End If
            Catch ex As Exception
            MessageBox.Show("Failed to connect to databse. System Error:" & ex.Message, "Database Error", MessageBoxButtons.OK, MessageBoxIcon.Error)
        End Try
            If conn.State <> ConnectionState.Closed Then
                conn.Close()
            End If
        End If

    End Sub

[rproffitt]

Just a thought. I don't .show the form until I've hidden or shown the objects I want to hide or show. Line 26 would be after the .hide .show items in my rendition.

WIth that out of the way, what issues or errors are you having?

[hericles]

You only set the sql statement once but at line 17 you're using it as part of an IF statement:
If sql = "SELECT Usertype FROM [db_dole].[dbo].[tbl_user] WHERE Usertype = 'Admin'" Then
Which will never be true so that's part of the problem.

Otherwise you're on the right track. You just need to pull out the user's role from the database when they log in and adjust your form accordingly.
And, remember, every time you pass unfiltered text into an SQL query a little puppy dies.

[Miurei]

Here I reprogram it

 Private Sub ok_Click(sender As Object, e As EventArgs) Handles ok.Click
            Dim conn As New SqlConnection
            If TextBox1.Text = "" Or TextBox2.Text = "" Then
                MessageBox.Show("Please fill in all fields.", "Login Error", MessageBoxButtons.OK, MessageBoxIcon.Error)
            Else
                 conn.ConnectionString = "Data Source=DOLE-PC\SQLEXPRESS;Initial Catalog=db_dole;Integrated Security=True;"
                Try
                    Dim sql As String = "SELECT UName, Password, Usertype  FROM [db_dole].[dbo].[tbl_user] WHERE UName='" & TextBox1.Text & "' AND Password='" & TextBox2.Text & "'"
                    Dim cmd As New SqlCommand(sql, conn)

                    cmd.Connection = conn
                    conn.Open()

                    Dim dr As SqlDataReader = cmd.ExecuteReader

                    If dr.Read = True Then
                        sql = "SELECT Usertype FROM [db_dole].[dbo].[tbl_user] WHERE Usertype = 'Admin'"
                        Me.Hide()
                        MessageBox.Show("      W E L C O M E !")
                        mainform.Show()

                        If sql = "SELECT Usertype FROM [db_dole].[dbo].[tbl_user] WHERE Usertype = 'Normal'" Then
                            Me.Hide()
                            MessageBox.Show("      W E L C O M E !")
                            viewform.edit.Visible = False
                            viewform.Summary.Visible = False
                            viewform.NewRec.Visible = False
                            viewform.RFresh.Visible = False
                            viewform.Show()
                        End If
                    Else
                        MessageBox.Show("Incorrect Username or Password.", "Login Failed", MessageBoxButtons.OK, MessageBoxIcon.Exclamation)
                    End If
                Catch ex As Exception
                    MessageBox.Show("Failed to connect to databse. System Error:" & ex.Message, "Database Error", MessageBoxButtons.OK, MessageBoxIcon.Error)
                End Try
                If conn.State <> ConnectionState.Closed Then
                    conn.Close()
                End If
            End If

        End Sub

this time it will log in using both users from admin and normal, but all where in mainform. i want normal users can access only Viewform...

[Santanu.Das]

You have wrote a wrong code lines to search usertype at line 16 in the if - end if statement. If dr.Read = True Then
'Wrong searching codes here
Else
End If
You already read data by calling ExecuteReader(). So, why are you calling an another Sal statement? You already have data to check UserType.
The codes should be like this.
If dr.Read = True Then
If adaReader("UserType")="Normal" Then
'Do your jobs here for normal
Else
'Doylur jobs for Admn
End if
Else
'Message here
End If
Hope it can help you.

[Miurei]

Thanks for all who tried to answer my query... anyway I solved it already... thanks again. hope you guys will continue to help those individuals out there needing your brilliant ideas.
;-) God bless all....