Member Avatar for pickachu

I have problem with my small vb program, just started to learn VB this week.

Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
        Dim s As String
        With record
            s = "SELECT * FROM user1"
            record.Open(s, data)

            If TextBox1.Text = record.Fields(0).Value And TextBox2.Text = record.Fields(1).Value Then
                MsgBox("OKKKK")
            Else
                MsgBox("WROOOOOOOOOOOONG!", MsgBoxStyle.Exclamation)
            End If
        End With
        record.Close()

    End Sub

The program seems to work but it queries only on row 1. Like if I have 2 columns (USERNAME and PASSWORD) with (row 1)ADMIN and ADMIN, (row 2)GUEST and GUEST.

It only displays the msgbox("OKKK") when I enter ADMIn and ADMIN while if I enter GUEST and GUEST, the msgbox("WRRoong!") is executed. How do I get it to work on both login information?

  • 4 Contributors
  • 4 Replies
  • 108 Views
  • 3 Days Discussion Span
  • Latest Post Latest Post by debasisdas

Dani AI

Generated

The behavior described by (only the first row matching) is consistent with reading a single record from a resultset and never advancing it. and are correct that iterating will find later rows; is also correct that a COUNT-based query can simplify the check. A more robust approach for authentication is to avoid client-side iteration entirely: issue a parameterized query that asks the database whether a matching credential row exists and let the database return a single scalar result. This is faster, avoids logic errors when not advancing a record pointer, and reduces data transfer.

Important practical points not yet covered in the thread:

  • Use parameterized commands to prevent SQL injection rather than concatenating values into SQL.
  • Do not store passwords in plain text. Store a salted, iterated hash (PBKDF2/BCrypt/Argon2) and compare hashed values.
  • Use proper disposal (Using blocks) so connections/commands always close, even on errors.
  • If sticking with legacy ADODB/Recordset code, check the recordset .EOF property and call .MoveNext; ensure .Close runs after the loop.

A concise VB.NET pattern (ADO.NET) shows the idea: single parameterized query that returns a count, then check > 0 for success.

Using conn As New SqlConnection(connectionString)
    Using cmd As New SqlCommand("SELECT COUNT(*) FROM user1 WHERE username=@u AND password=@p", conn)
        cmd.Parameters.Add("@u", SqlDbType.NVarChar, 50).Value = TextBox1.Text.Trim()
        cmd.Parameters.Add("@p", SqlDbType.NVarChar, 128).Value = HashPassword(TextBox2.Text)
        conn.Open()
        Dim matches As Integer = Convert.ToInt32(cmd.ExecuteScalar())
        If matches > 0 Then
            MessageBox.Show("OKKKK")
        Else
            MessageBox.Show("WROOOOOOOOOOOONG!", "Login", MessageBoxButtons.OK, MessageBoxIcon.Exclamation)
        End If
    End Using
End Using

Further reading on secure storage and injection prevention: OWASP Password Storage Cheat Sheet and OWASP SQL Injection Prevention Cheat Sheet.

Recommended Answers

All 4 Replies

Member Avatar for pokahantos

Did you check both rows rather than the first one only!

Member Avatar for pickachu

How? I did not get what you mean..

Member Avatar for MehdiAnis

You have to have a loop to read all the rows. I am not sure about the code, but I am giving you the idea:-

While Record.Read = true
If TextBox1.Text = record.Fields(0).Value And TextBox2.Text = record.Fields(1).Value Then
MsgBox("OKKKK")
GoTo ENDING
END IF
Record.ReadNext
LOOP

MsgBox("WROOOOOOOOOOOONG!", MsgBoxStyle.Exclamation)

ENDING:
Record.close()
END SUB

Member Avatar for debasisdas

The best solution for the problem is to use COUNT() .
Take the user input from textbox and using count findout the number of records in database which satisfies the condition. If it is 1 then say OK (login successful and proceed further) else wrong(login failed)
For this the username field should be the primary key of the table.

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.