c# - Don't meet the condition in if() but it dosen't show the MessageBox.show(""); Everything else works just fine -
public partial class formlogin : form { private oledbconnection connection = new oledbconnection(); //private bool checkusername = false; public formlogin() { initializecomponent(); connection.connectionstring = @"provider=microsoft.ace.oledb.12.0;data source=d:\class\this semester\c#\code\access login app\database1.accdb;persist security info=false;"; } private void form1_load(object sender, eventargs e) { try { connection.open(); dbchecklabel.text = "connected"; connection.close(); } catch(exception ex) { messagebox.show("error:" + ex); } } private void log_in_btn_click(object sender, eventargs e) { try { oledbcommand command = new oledbcommand(); connection.open(); command.connection = connection; command.commandtext = "select * acctbl username=" + txt_bx_username.text + "and password ='" + txt_bx_password.text + "';"; oledbdatareader reader = command.executereader(); while (reader.read()) { string username = reader.getvalue(reader.getordinal("username")).tostring(); string password = reader.getvalue(reader.getordinal("password")).tostring(); if (username.equals(txt_bx_username.text)) { if (password.equals(txt_bx_password.text)) { this.hide(); formprofile f1 = new formprofile(); f1.show(); } else messagebox.show("incorrect pass"); } else messagebox.show("incorrect username"); } reader.close(); connection.close(); } catch (exception ex) { messagebox.show("error: " + ex); connection.close(); } } } here code login page. goes next if user name , password correct don't show message in else block if user name or password not matched.
private void log_in_btn_click(object sender, eventargs e) { try { oledbcommand command = new oledbcommand(); connection.open(); command.connection = connection; command.commandtext = "select `username`, `password` acctbl;"; oledbdatareader reader = command.executereader(); while (reader.read()) { string username = reader.getvalue(reader.getordinal("username")).tostring(); string password = reader.getvalue(reader.getordinal("password")).tostring(); if (username.equals(txt_bx_username.text)) { if (password.equals(txt_bx_password.text)) { this.hide(); formprofile f1 = new formprofile(); f1.show(); } else { messagebox.show("incorrect pass"); } } else { messagebox.show("incorrect username"); } } reader.close(); connection.close(); } catch (exception exbtn) { messagebox.show("error" + exbtn); connection.close(); } } after got site coded right below. value database record , check if match entered username check if match recorded password. if not shows message box. works fine.
your code dangerous.
there several security issues it.
the reason code not work quite simple: try read record database given username , password. if username or password incorrect, not retrieve record, while(reader.read()) never executes.
if do retrieve record, utterly useless compare username , password, always match because read them database.
fix sql-injection issue, store password hashes instead of plain text passwords , use different algorithm check:
either try read records database given username , hashed password , return error if no record found, or read record database username check retrieved password hash.
in either case, return generic error message if wrong. not give out information being username or password wrong. simple "incorrect username or password" enough.
Comments
Post a Comment