0

I receive this error every time I try log in with incorrect details which should show a message-box "invalid username..." and when no details are entered it should show "please enter...

    conn = New MySqlConnection
    conn.ConnectionString = "server=localhost; userid=root; password=...; database=..."
    Dim reader As MySqlDataReader

    Try
        conn.Open()
        Dim Query As String
        Query = "SELECT Username, Password, Admin FROM appointments.tblLogin WHERE Username='" & TextBox_Username.Text & "' AND Password='" & TextBox_Password.Text & "' "
        cmd = New MySqlCommand(Query, conn)
        reader = cmd.ExecuteReader

        Dim count As Integer
        count = 0
        While reader.Read
            count = count + 1
        End While

        If reader.GetInt32("Admin") = 1 Then
            AdminMainMenu.Show()
            Me.Hide()
        ElseIf reader.GetInt32("Admin") = 0 Then
            MainMenu.Show()
            Me.Hide()
        Else
            MessageBox.Show("Invalid username or password")
        End If

        If TextBox_Username.Text.Equals("") And TextBox_Password.Text.Equals("") Then
            MessageBox.Show("Please enter a username and password")
        End If

        conn.Close()

    Catch ex As MySqlException
        MessageBox.Show(ex.GetBaseException.ToString)
    Finally
        conn.Dispose()
    End Try

1 Answer 1

0

The MySqlDataReader can move forward-only, once it reaches the end of the rows retrieved by the command, it cannot go back to read previous rows.
The loop used to count the number of rows moves the reader to the end of the data stream. So trying to read the Admin field result in an exception.

If TextBox_Username.Text.Equals("") And _
   TextBox_Password.Text.Equals("") Then
    MessageBox.Show("Please enter a username and password")
   Return
End If

.... opening and executing the command code....

If reader.Read Then
    Dim isAdmin = (reader.GetInt32("Admin") = 1)
    If isAdmin Then
       AdminMainMenu.Show()
       Me.Hide()
    Else Then
       MainMenu.Show()
       Me.Hide()
    End If
Else 
    MessageBox.Show("Invalid username or password")
End If
conn.Close()

Notice that I have removed the loop and used a simple if/else statement around the Read method to display the error message and I have changed the reading of the Admin flag creating a boolean variable to simplify the logic inside the true part of the if block.

Said that, you need to look at how build parameterized queries because your string concatenation to build the commandtext exposes your program to Sql Injection Attacks (not to mention syntax errors if some of your textbox contains a single quote, try it...)

Consider also that from a security standpoint you should never store passwords in the database in clear text. Use always an hash of the password

4
  • It's sorted it out a bit thanksfor the help. However It doesn't show the error message and won't show the message-box either.
    – user5725037
    Dec 29, 2015 at 17:06
  • thanks for the help! yeah all security and validation with regex etc. I am aiming to do later, I want to finish all the core coding before moving onto the details such as hashing and stopping sql injection attacks. Do you know of any good websites or such for learning hashing and building parameterized queries?
    – user5725037
    Dec 29, 2015 at 17:19
  • 'I presume this is parameterized quries slightly? cmd = New MySqlCommand(Query, conn) cmd.Parameters.AddWithValue("@username", TextBox_Username2.Text) cmd.Parameters.AddWithValue("@password", TextBox_Password2.Text) cmd.Parameters.AddWithValue("@firstName", TextBox_Forename.Text) cmd.Parameters.AddWithValue("@surname", TextBox_Surname.Text) cmd.Parameters.AddWithValue("@telephoneNo", TextBox_TeleNo.Text)
    – user5725037
    Dec 29, 2015 at 17:57
  • Yes but forget AddWithValue. It is a trap waiting to catch you. See Can we stop using AddWithValue already?, it is about Sql Server but the concepts are the same.
    – Steve
    Dec 29, 2015 at 18:16

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.