visual basic window Login Form to sql Server Database

This is my code and I dont know where should the code go on the login button or the login form. please help

-------------------------------------------------------------------------------------

Public Class frmLogin

Dim con As New SqlClient.SqlConnection
Dim da As New SqlClient.SqlDataAdapter
Dim ds As New DataSet
Dim sqlquery As String
Private Sub frmLogin_Load(sender As Object, e As EventArgs) Handles MyBase.Load
con.ConnectionString = "Data Source=ABRAM-PC\SQLEXPRESS;Initial Catalog=Login;Integrated Security=True"

End Sub

Private Sub btnLogin_Click(sender As Object, e As EventArgs) Handles btnLogin.Click
Try
'checking if the username and password field is null

If Len(Trim(txtUserName.Text)) = 0 Then
MessageBox.Show("Enter the user name", "Input Error !", MessageBoxButtons.OK, MessageBoxIcon.Error)
Exit Sub
txtUserName.Focus()
End If
If Len(Trim(txtPass.Text)) = 0 Then
MessageBox.Show("Enter the password", "Input Error !", MessageBoxButtons.OK, MessageBoxIcon.Error)
Exit Sub
txtPass.Focus()
End If

'executing SQL Query for retrieving the username and password from the database table

con.Open()
sqlquery = "SELECT * FROM LoginTable WHERE user_name='" & txtUserName.Text & "' and password='" & txtPass.Text & "' "
da = New SqlClient.SqlDataAdapter(sqlquery, con)
da.Fill(ds, "LoginTable")
If ds.Tables("LoginTable").Rows.Count <> 0 Then
MessageBox.Show("Login succeed", "Success", MessageBoxButtons.OK, MessageBoxIcon.Information)
Else
MessageBox.Show("Invalid user name and password", "Access denied", MessageBoxButtons.OK, MessageBoxIcon.Error)
End If
con.Close()

clear() 'calling clear method here

Catch ex As Exception
MessageBox.Show(ex.Message, "Exception generated", MessageBoxButtons.OK, MessageBoxIcon.Error)
End Try
End Sub

' declaring a method for clearing the controls
Public Sub clear()
txtPass.Clear()
txtUserName.Clear()
End Sub

' code for show password
Private Sub chkshowpass_CheckedChanged(sender As Object, e As EventArgs) Handles chkshowpass.CheckedChanged
If chkshowpass.Checked = True Then
txtPass.UseSystemPasswordChar = False
Else
txtPass.UseSystemPasswordChar = True
End If
End Sub
End Class

Your code should go within Button's Click event. Just a reminder, you should not append the value of TextBox directly to you SQL string as it can leads you to SQL Injection attack. You should use parameterize query instead. For example:

Private Sub Validate(ByVal userName As String, ByVal passWord As String)
Dim sqlStatement As String = "SELECT * FROM LoginTable WHERE user_name = @UserName and password =@Password"
Using connection As SqlConnection = New SqlConnection("YOUR CONNECTION STRING HERE")
Using cmd As SqlCommand = New SqlCommand(String.Format(sqlStatement, inclause), connection)
cmd.Parameters.AddWithValue("@UserName", userName)
cmd.Parameters.AddWithValue("@Password", passWord)
Dim dt As DataTable = New DataTable()
Dim ad As SqlDataAdapter = New SqlDataAdapter(cmd)
ad.Fill(dt)
If dt.Rows.Count > 0 Then
MessageBox.Show("Login succeed", "Success", MessageBoxButtons.OK, MessageBoxIcon.Information)
Else
MessageBox.Show("Invalid user name and password", "Access denied", MessageBoxButtons.OK, MessageBoxIcon.[Error])
End If
End Using
End Using
End Sub

You can then call the method above like this at your Button's Click event:

Validate(txtUserName.Text,txtPass.Text)

1 Reply

Know the answer? Post it — somebody with the same question will find it here.

Vincent Maverick Durano8y ago
Your code should go within Button's Click event. Just a reminder, you should not append the value of TextBox directly to you SQL string as it can leads you to SQL Injection attack. You should use parameterize query instead. For example:
Private Sub Validate(ByVal userName As String, ByVal passWord As String)
    Dim sqlStatement As String = "SELECT * FROM LoginTable WHERE user_name = @UserName and password =@Password"

    Using connection As SqlConnection = New SqlConnection("YOUR CONNECTION STRING HERE")

        Using cmd As SqlCommand = New SqlCommand(String.Format(sqlStatement, inclause), connection)
            cmd.Parameters.AddWithValue("@UserName", userName)
            cmd.Parameters.AddWithValue("@Password", passWord)
            Dim dt As DataTable = New DataTable()
            Dim ad As SqlDataAdapter = New SqlDataAdapter(cmd)
            ad.Fill(dt)

            If dt.Rows.Count > 0 Then
                MessageBox.Show("Login succeed", "Success", MessageBoxButtons.OK, MessageBoxIcon.Information)
            Else
                MessageBox.Show("Invalid user name and password", "Access denied", MessageBoxButtons.OK, MessageBoxIcon.[Error])
            End If
        End Using
    End Using
End Sub
You can then call the method above like this at your Button's Click event:
Validate(txtUserName.Text,txtPass.Text)
0