Mysql

[solid2005]

public bool LoginAccount(string username, string password)
        {
            string query = "SELECT * FROM login where userid = '" + username + "'";
            string _dbReader;
            bool _check = false;
            //Open connection
            if (this.OpenConnection() == true)
            {
                //Create Command
                MySqlCommand cmd = new MySqlCommand(query, connection);
                //Create a data reader and Execute the command
                MySqlDataReader dataReader = cmd.ExecuteReader();

                //Read the data and store them in the list
                if (dataReader.HasRows)
                {
                    if (dataReader.Read())
                    {
                        _dbReader = Convert.ToString(dataReader["user_pass"]);
                        _accountid = Convert.ToInt32(dataReader["account_id"]);
                        if (_dbReader == password)
                        {
                            _check = true;
                        }
                        else
                        {
                            MessageBox.Show("Incorrect password.");
                        }
                    }
                }
                else
                {
                    _check = false;
                    MessageBox.Show("Account not found", username, MessageBoxButtons.OK, MessageBoxIcon.Information);
                }
                //close Data Reader
                dataReader.Close();
                //close Connection
                this.CloseConnection();
            }
            else
            {
                _check = false;
                MessageBox.Show("Server is closed.");
            }
            return _check;
        }

        //Create Character
        public bool CreateCharacter(string name, string job)
        {
            bool _check = false;
            try
            {
                string query = "INSERT INTO characters (account_id, name, class) VALUES('" + _accountid + "' ,'" + name + "' ,'" + job + "')";
                //open connection
                if (this.OpenConnection() == true)
                {
                    //create command and assign the query and connection from the constructor
                    MySqlCommand cmd = new MySqlCommand(query, connection);
                    //Execute command
                    cmd.ExecuteNonQuery();
                    MessageBox.Show("Create Successful.");
                    _check = true;
                }
            }
            catch (Exception ex)
            {
                _check = false;
                if (ex.Message.IndexOf("name") >= 0)
                    MessageBox.Show("That Character already exists. Please change the Character Name.");
                else
                    MessageBox.Show(ex.Message);
            }
            finally
            {
                //close connection
                this.CloseConnection();
            }
            return _check;
        }

im confus about insert _account_id it's always 0 when passing value