C# OleDb Login Validation doesn't work

Question

So basically I am creating a login system using C#.net and MS access.I am using a class to deal with all the connections but basically the username and password values are passed to the method in the connection class and I am trying to check the credentials from the text boxes against the database.

Problem is, when I use executenonquery it allows any credentials to be entered even if they are not in the database.

I am currently using ExecuteReader and checking whether the reader is returning true. Problem is it always returns false even when the credentials that are entered are present in the database. I have no idea what is wrong.

public static bool adminLoginIn(string user, string password) //method to allow the admin to log in to the admin panel
    {
        OleDbConnection myConnection = GetConnection(); //calls the connection method which returns database connection string
        string myQuery = "SELECT * FROM Staff WHERE Username = '" + user + "' AND Password = '" + password + "'";
        OleDbCommand myCommand = new OleDbCommand(myQuery, myConnection);

        try
        {
           myConnection.Open(); //open the database connection
           OleDbDataReader dr = myCommand.ExecuteReader(); 

           if (dr.Read())
           {
               return true;
           }
           else
           {
               return false;
           }

        }

        catch (Exception ex)
        {
            return false;
        }
        finally
        {
            myConnection.Close(); //close the database connection
        }

    }

Just use `' OR 1=1` for the password; that will always work. — Dour High Arch, Nov 25 '15 at 21:17
This code hurts on so many levels. Please look up SQL injection (e.g. http://stackoverflow.com/q/601300/91696) and the `using` statement (e.g. http://stackoverflow.com/q/75401/91696). — Albireo, Nov 26 '15 at 09:40

score 0 · Answer 1 · edited May 23 '17 at 10:27

0

If it's always returning false no matter what, checking your catch statement is a prime suspect: if your code is raising an exception you're swallowing it and returning false.

Remove the try/catch and replace it with a using (and apply it to the other IDisposables, too).

edited May 23 '17 at 10:27

Community

1
1

answered Nov 26 '15 at 09:48

Albireo

10,977
13
62
96

C# OleDb Login Validation doesn't work

1 Answers1