Member Avatar for Maylene_1

Hi, below is the code in my login button, yet I'm confused what code to put in logout button. I only know few knowledge about vb.net and I am trying to understand it as much as I can. Thank you for understanding! :)

Public Class Form2

    Private OPConStr As String = ("server=localhost;username=root;password=07292021;database=usersaccount")

    Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click
        Dim ID As Integer
        Using connection As New MySqlConnection(OPConStr),
            cmd As New MySqlCommand("SELECT `StudentId` FROM `usersaccount` WHERE `StudentId` = @username AND `Account Password` = @password", connection)
            cmd.Parameters.Add("@username", MySqlDbType.VarChar).Value = Username.Text
            cmd.Parameters.Add("@password", MySqlDbType.VarChar).Value = Pass.Text
            connection.Open()
            ID = CInt(cmd.ExecuteScalar())
        End Using
        If ID = 0 Then
            MessageBox.Show("Invalid Username Or Password")
            Exit Sub
        End If
        Using con As New MySqlConnection("server=localhost;username=root;password=07292021;database=logsrecord"),
                cmd As New MySqlCommand("Insert into loghistory.logsrecord (StudentID, DateIn, Action) Values (@ID, @In, @Action);", con)
            cmd.Parameters.Add("@ID", MySqlDbType.VarChar).Value = ID
            cmd.Parameters.Add("@In", MySqlDbType.DateTime).Value = Now()
            cmd.Parameters.Add("@Action", MySqlDbType.Int32).Value = 1
            con.Open()
            cmd.ExecuteNonQuery()
        End Using
        Form3.Show()
        Hide()
    End Sub

This is the table in my database:

  • StudentID (VarChar)
  • In (Datetime)
  • Out (Datetime)
  • Action (Int)
  • 3 Contributors
  • 2 Replies
  • 340 Views
  • 12 Hours Discussion Span
  • Latest Post Latest Post by Santanu.Das

Dani AI

Generated

Good points from (security) and (checking ExecuteScalar). A robust, maintainable pattern is: insert a login row and capture that new row’s primary key (LogID), keep LogID in the running session (or pass it to the next form), and use that exact LogID to update the logout time. That avoids ambiguity when the same student has multiple open sessions.

Example: insert + get last-inserted id (use a transaction so the two steps are atomic)

' after credential validation
Dim logId As Long
Using con As New MySqlConnection(connStr)
  con.Open()
  Using tx = con.BeginTransaction()
    Using ins As New MySqlCommand("INSERT INTO loghistory.logsrecord (StudentID, DateIn, Action) VALUES (@ID,@In,1)", con, tx)
      ins.Parameters.AddWithValue("@ID", ID)
      ins.Parameters.AddWithValue("@In", DateTime.Now)
      ins.ExecuteNonQuery()
    End Using
    Using lastCmd As New MySqlCommand("SELECT LAST_INSERT_ID()", con, tx)
      logId = Convert.ToInt64(lastCmd.ExecuteScalar())
    End Using
    tx.Commit()
  End Using
End Using
Form3.LogId = logId

Logout: update the exact row by LogID, with a safe fallback that updates the most recent open row if LogID is not available.

Using con As New MySqlConnection(connStr)
  Using cmd As New MySqlCommand("UPDATE loghistory.logsrecord SET DateOut=@Out, Action=0 WHERE LogID=@LogID", con)
    cmd.Parameters.AddWithValue("@Out", DateTime.Now)
    cmd.Parameters.AddWithValue("@LogID", Me.LogId)
    con.Open()
    If cmd.ExecuteNonQuery() = 0 Then
      Using fb As New MySqlCommand("UPDATE loghistory.logsrecord SET DateOut=@Out, Action=0 WHERE StudentID=@ID AND DateOut IS NULL ORDER BY DateIn DESC LIMIT 1", con)
        fb.Parameters.AddWithValue("@Out", DateTime.Now)
        fb.Parameters.AddWithValue("@ID", currentStudentId)
        fb.ExecuteNonQuery()
      End Using
    End If
  End Using
End Using

Design & troubleshooting tips: add an INT AUTO_INCREMENT primary key (LogID); use column names like DateIn/DateOut (avoid reserved words or spaces); check ExecuteScalar for DBNull before converting; store the DB connection string securely (not hard-coded); and store password hashes (modern algorithms such as bcrypt/Argon2/PBKDF2) rather than plaintext. Also plan for orphaned sessions (application crash): either mark stale rows after a timeout or run a maintenance job to close them.

Recommended Answers

All 2 Replies

Member Avatar for rproffitt

Two issues here.

  1. Never store passwords in a database. This is something we must teach from day one in any compsci class. More at https://www.google.com/search?&q=never+store+passwords+in+a+database
  2. As to logout, the usual is to set a flag or value that they passed the login check. To log out you clear that flag.

Some may write "it's only for school." Again, this should get a failing grade or at least a mark or two down for it's lack of security.

Member Avatar for Santanu.Das

Use of Executescalar() function to get the count of record numbers.
Therefore, you must have to use Count keyword before StudentId into the select statement.

My suggestion:
Store StudentId and do same in logout procedure as you do in log in

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.