How do I get the value from database in mysql query?

Question

So we're having a log-in form in which the program must detect what position the user is assigned to. (selecting position is done during sign-up, so position of the user is saved into the database already). Supposedly, there is a separate form for every position.

Dim username As String = txtUser.Text
Dim password As String = txtPass.Text

//check if username and password exist
 checklogin(username, password)
        If RS.EOF Then
            MessageBox.Show("Mismatch Entry", "confirmation Message", MessageBoxButtons.OKCancel, MessageBoxIcon.Error)
            txtUser.Clear()
            txtUser.Focus()
        Else
            Me.Hide()
            //problem starts here
            checkposition()
            If (position == "Officer")
                OfficerForm.Show()
            Elseif (position == "Head")
                HeadForm.Show()
            Elseif (position == "Admin")
                AdminForm.Show()
            Else
             // dialog box
        End If
    End Sub

The method for checkposition:

Public Sub checkpositon(ByVal username As String, ByVal positon As String)
    RS = CN.Execute("SELECT position FROM admin WHERE uName = '" & username & "' ")
End Sub

I know there's still something missing in the code. and I know what's wrong with it. How will the position in the database be retrieved into the log-in form? PLEASE HELP :( Thank you!

You are vulnerable to sql-injection attacks. Always use sql-parameters instead of string concatenation. Consider that `username` is `';Drop table admin;--` — Tim Schmelter, Oct 06 '14 at 09:13
[Sql Injection Explained](http://stackoverflow.com/questions/332365/how-does-the-sql-injection-from-the-bobby-tables-xkcd-comic-work) — Steve, Oct 06 '14 at 09:27
But this is how we do it in school. A little but of shortened. — Luz Angeli Taboso, Oct 06 '14 at 09:30
Sadly this is universal. Please, show the link to your buddies. — Steve, Oct 06 '14 at 09:35

niekoost · Answer 1 · 2014-10-06T09:40:32.317

0

the second parameter of the function checkposition() should be named 'position' in stead of 'positon'. Furthermore, you need to assign a value to position, for instance

position = RS.Fields.Item(0);

And you should escape the value of username as well

edited Oct 06 '14 at 09:40

answered Oct 06 '14 at 09:18

niekoost

151
2
5

which part of position are you referring to? I know I have to use RS. But I dont know how. – Luz Angeli Taboso Oct 06 '14 at 09:23
CN.Execute will return a recordset (RS). I guess you'll expect exactly one result, otherwise you would have placed a check on RS.EOF after executing your query. I changed my answer a bit – niekoost Oct 06 '14 at 09:39

How do I get the value from database in mysql query?

1 Answers1