C# windows application with MySql

Question

I have copied the exact code from a tutorial and all the connection build up thing is working and my Sql select statement is also working just that the Reader command is not functioning the Reader is malfunctioning and does not incrementing the Count value.

Heres my Code

 using System;
 using System.Collections.Generic;
 using System.ComponentModel;
 using System.Data;
 using System.Drawing;
 using System.Linq;
 using System.Text;
 using System.Threading.Tasks;
 using System.Windows.Forms;
 using MySql.Data.MySqlClient;

namespace WindowsFormsApplication5
{
public partial class Form1 : Form
{
    public Form1()
    {
        InitializeComponent();
    }

    private void button1_Click(object sender, EventArgs e)
    {
        try
        {
            string myConnection = "datasource= localhost;port=3306;username=root;password=2905";
            MySqlConnection myConn = new MySqlConnection(myConnection);

            MySqlCommand Selectcommand = new MySqlCommand("select *from mydb.supervisors where username='" + this.text1_txt + "' and password = '" + this.text2_txt + "';", myConn);

            myConn.Open();
            MySqlDataReader myReader;

            myReader = Selectcommand.ExecuteReader();
            int count = 0;
            while (myReader.Read())
            {
                count = count + 1;
            }
            if (count == 1)
            {
                MessageBox.Show("Yayyyy");
            }
            else if (count > 1)
            {
                MessageBox.Show("Duplicate Parameters - Accesss Denied");

            }
            else if (count == 0)
            {
                MessageBox.Show("UserName, Password Dont Match with Hostel");
                myConn.Close();
            }
            }




        catch (Exception ex)
        {

            MessageBox.Show(ex.Message);
        }
    }

}
}

Your code will be very easy to hack! Please read up on SQL injection attacks and mySQL parameters. https://blog.udemy.com/sql-injection-tutorial/ and http://stackoverflow.com/questions/652978/parameterized-query-for-mysql-with-c-sharp — beercohol, Aug 05 '16 at 13:04

Mithrandir · Answer 1 · 2016-08-05T13:33:03.590

I assume you meant to write:

this.text1_txt.Text and this.text2_txt.Text

instead of just this.text1_txt and this.text2_txt. Using just this.text2_txt will use the ToString() method to get a string from your object for concatanation.

You should use parameters ...

MySqlCommand Selectcommand = 
      new MySqlCommand(
         @"select * from mydb.supervisors 
            where username= @username and password = @password;", myConn);

Selectcommand.Parameters.AddWithValue("@username ", this.text1_txt.Text);
Selectcommand.Parameters.AddWithValue("@password", this.text2_txt.Text);

Your query will most likely yield one or zero lines as a result, but you might want to try this:

MySqlCommand Selectcommand = 
      new MySqlCommand(
         @"select count(*) as numrows from mydb.supervisors 
            where username= @username and password = @password;", myConn);

int numrows =  (int) Selectcommand.ExecuteScalar(); 

if (numrows == 1)
{
    MessageBox.Show("Yayyyy");
}
...

Mostafiz · Answer 2 · 2016-08-05T13:04:37.780

0

Your MySql command has some problems, you forgot a space after * also if you are using username and password from textbox then you have to use Text property. That's why no data is reading and no count increment.

MySqlCommand Selectcommand = new MySqlCommand("select * from mydb.supervisors where username='" + this.text1_txt.Text + "' and password = '" + this.text2_txt.Text + "';", myConn);

edited Aug 05 '16 at 13:04

answered Aug 05 '16 at 12:59

Mostafiz

7,243
3
28
42

score 0 · Answer 3 · answered Aug 05 '16 at 13:20

Additional to the comments above, if your are only interested in the number of records being returned then you may be better with the following SQL statement to only return the count of records. With only a couple of rows, the SELECT * FROM will work, but if you hit a table with a very high number of records, then the SELECT * FROM would bring back ALL of that data and could affect performance of an application; whereas the COUNT(*) doesn't bring back the data.

SELECT COUNT(*) AS RECORD_COUNT
FROM MYDB.SUPERVISORS
WHERE ...

reader.Read();

if (reader[0] != 1)
{
  MessageBox.Show("Access Denied");
  return;
}

If you really must keep the stack of "IF" then, you should consider using "SWITCH" instead. That myConn.Close(); is inside the last IF, so wouldn't get called when the count isn't 0

I guess it depends on what you're using this for, but personally, if I am going to deny access (as part of a login), I would never offer any explanation of why access is denied - as this can help people to get in, when thy shouldn't.

C# windows application with MySql

3 Answers3