-1

[As what the title say.... This pops up whenever I try to click Login. Just enter image description here

I also have another system with the same one but it doesn't have an error like this and right now I'm too blind to search for what's wrong XDD

private void btnLogin_Click(object sender, EventArgs e)
{
  try
  {
    string constring = @"Provider=Microsoft.Jet.OLEDB.4.0;Data Source=
    |DataDirectory|\MMG.mdb";
    string cmdText = ("SELECT COUNT(*) FROM Accounts WHERE User_name=? AND Pass_word=?");
    using (OleDbConnection con = new OleDbConnection(constring))
    using (OleDbCommand cmd = new OleDbCommand(cmdText, con))
    {
        con.Open();
        cmd.Parameters.AddWithValue("@UName", txtUserName.Text);
        cmd.Parameters.AddWithValue("@PWord", txtPassword.Text);
        DataTable dt = db.execQuery("SELECT * FROM Accounts WHERE User_name='" + txtUserName.Text + "' AND Pass_word='" + txtPassword.Text + "'");

        if (dt.Rows.Count > 0)
        {
            if (dt.Rows[0].ItemArray[5].ToString() == "Manager")
            {
                this.Hide();
                frmMainForm mnf = new frmMainForm();
                mnf.ShowDialog();
                this.Close();
            }
            else if (dt.Rows[0].ItemArray[5].ToString() == "Cashier")
            {
                this.Hide();
                Sales mnf = new Sales();
                mnf.ShowDialog();
                this.Close();
            }
        }
    }
}

Thanks for the solution in advance ! :)

MethodMan
  • 18,625
  • 6
  • 34
  • 52
Sam
  • 19
  • 6
  • do a Rows.Length and Rows[0].Length and you will know what went wrong – Steve Aug 19 '16 at 16:03
  • 2
    Can I use `'; DROP TABLE Accounts;--` as a password? You should *really* check that there are any results before trying to access them. You have far, far bigger problems though as your code allows hacking your application in seconds – Panagiotis Kanavos Aug 19 '16 at 16:03
  • 2
    I'm betting on the 5 on `dt.Rows[0].ItemArray[5]` – Jcl Aug 19 '16 at 16:03
  • You're essentially trying to reference something that doesn't exist in an array. The suspicious part of the code to me looks like `dt.Rows[0].ItemArray[5].ToString()` Have you tried debugging to see how many items you have in your array? Don't forget that arrays are `0 based` indexes ;) – Geoff James Aug 19 '16 at 16:04
  • 4
    I smell a delicious site to practice my injection skills. – Adam Aug 19 '16 at 16:04
  • 1
    I suggest dropping all this code and using .NET's built-in authentication mechanisms. They work, they are tested, they allow integration with external providers like Facebook and two-factor authentication. – Panagiotis Kanavos Aug 19 '16 at 16:05
  • @Steve I refer to the *new* mechanisms. It's *not* hard to integrate the old ones either. Definitely easier than trying to recreate them. – Panagiotis Kanavos Aug 19 '16 at 16:06
  • @Sam - Top tip for future - your error is being good to you and telling you the file *and* line number ;) – Geoff James Aug 19 '16 at 16:08
  • @Steve *Identity* is not tied to MVC5. And it does get updated through NuGet regularly – Panagiotis Kanavos Aug 19 '16 at 16:10
  • @Steve - AFAIK, OWIN isn't outdated is it? I though it's more of a standard authentication practice in .NET nowadays? – Geoff James Aug 19 '16 at 16:11
  • that might be a confusion since ItemArray is zero based and you're trying to get the 5th element which is actually index 4. – derloopkat Aug 19 '16 at 16:11
  • ` if (dt.Rows[0].ItemArray[4].ToString() == "Manager") { ... } else if (dt.Rows[0].ItemArray[4].ToString() == "Cashier") { ... } } ` GOT IT GUYS XD I forgot I deleted a column on my database. Thank you for the hints! <3 – Sam Aug 19 '16 at 16:18
  • @Sam Go read the linked duplicate, it has an excellent explanation on how to resolve this issue on your own. Don't be lazy, learn how to do this yourself. – DavidG Aug 19 '16 at 16:20
  • @DavidG I already did fixed it! :) I forgot I deleted a column on my database. Thanks anyway! ^^ – Sam Aug 19 '16 at 16:26

1 Answers1

1

You need a check for ItemArray:

if(dt.Rows.Count > 0)
{
   if(dt.Rows[0].ItemArray.Length > 5)
   {
      // YOUR CODE
   }
}
Oluwafemi
  • 14,243
  • 11
  • 43
  • 59
  • should be >5 really – Steve Aug 19 '16 at 16:04
  • you should also check if dt.Rows[0] != null and Rows[0].ItemArray != null – hpfs Aug 19 '16 at 16:12
  • ` if (dt.Rows[0].ItemArray[4].ToString() == "Manager") { ... } else if (dt.Rows[0].ItemArray[4].ToString() == "Cashier") { ... } } ` GOT IT GUYS XD I forgot I deleted a column on my database. Thank you for the hints! <3 – Sam Aug 19 '16 at 16:14