|
-
Aug 24th, 2012, 09:44 AM
#11
Thread Starter
New Member
Re: Login Form update query
Hi All,
Thanks for all the help the below is my final mark up of the code minus the hash function on the password data,
Code:
Private Sub btnLogin_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnLogin.Click
'create connection string and connect to db
Dim conn As SqlClient.SqlConnection
conn = New SqlClient.SqlConnection
conn.ConnectionString = ("Data Source=ALEX-LAPTOP\SQLEXPRESS;Initial Catalog=sldb;Integrated Security=True;Pooling=False")
Try
conn.Open()
Catch myerror As Exception
MessageBox.Show("Error Connecting to Database: " & myerror.Message)
End Try
'create query, execute and put into reader
Dim selectAdapter As New SqlClient.SqlDataAdapter
Dim sqlselectquery = "SELECT username, password FROM Users Where username='" & txtUsername.Text & "' and password='" & txtPassword.Text & "'"
Dim selectCommand As New SqlClient.SqlCommand
selectCommand.Connection = conn
selectCommand.CommandText = sqlselectquery
selectAdapter.SelectCommand = selectCommand
Dim selectData As SqlClient.SqlDataReader
selectData = selectCommand.ExecuteReader()
'check for correct credentials
If selectData.HasRows = 0 Then
MessageBox.Show("Invalid Login Details", "Login Error", MessageBoxButtons.OK, MessageBoxIcon.Error)
Else
currentuser = Me.txtUsername.Text
'run update query to update logged_in field to true
conn.Close()
Dim updateAdapter As New SqlClient.SqlDataAdapter
Dim sqlupdatequery = "UPDATE Users SET logged_in='True' WHERE username='" & txtUsername.Text & "' and password='" & txtPassword.Text & "'"
Dim updatecommand As New SqlClient.SqlCommand
updatecommand.Connection = conn
updatecommand.CommandText = sqlupdatequery
updateAdapter.UpdateCommand = updatecommand
conn.Open()
updatecommand.ExecuteNonQuery()
conn.Close()
Dim homeform = New frmHome
homeform.Show()
Me.Visible = False
End If
End Sub
This works perfectly and i have also modified the select query to work on the home form to decide whether the user is an admin or not and display the admin button.
For the hash function should i have a registration form which hashes the user's password when it is added to the database? Is this enough or do i also need to hash the username aswell? Also as for the data stored in the database other than the authentication data, should that also be hashed or is it OK to just display it as text? This would be people's personal details and information on when they took leave in their work place.
Thanks!
Alex
Tags for this Thread
Posting Permissions
- You may not post new threads
- You may not post replies
- You may not post attachments
- You may not edit your posts
-
Forum Rules
|
Click Here to Expand Forum to Full Width
|