🔒 Locked

SQL Server Express 2005 confusing...

Started by Afr0m@n Mar 30, 2006 at 7:01 AM 2 replies 450+ views

Original Post

Mar 30, 2006 at 7:01 AM

Ok, i've downloaded SQL Server 2005 Express + Database management tool, and it's confusing as #¤%(¤%(/ ! I've created a table with two rows, which are named "AccountName" and "AccountPassword" respectively. What I want to achieve for starters is to be able to create accounts manually but also have a function of sorts that creates accounts automatically based on that table. I also need to be able to query the database from C# to figure out if an account exists and whatnot. I've searched for tutorials about using the database management tool, but I can't find anything that seems to describe what I want to do. Can someone please help?

CadetUmfer

Mar 30, 2006 at 10:36 AM

*shrug* Something like this I guess

SqlConnection conn = new SqlConnection([ConnectionString]);public bool Login(string name, string pass){  SqlCommand cmd = new SqlCommand("select * from Account where AccountName=' + name + "' and AccountPassword = '" + pass +"'", conn);  Object result = cmd.ExecuteScalar();  if (res != null)    return true;  else    return false;}

Billr17

Mar 30, 2006 at 10:55 AM

Quote:

Original post by CadetUmfer

  SqlCommand cmd = new SqlCommand("select * from Account where AccountName=' + name + "' and AccountPassword = '" + pass +"'", conn);}

Using the plus operator to tack on the variables is a bad thing (SQL Injection Attacks may be easier to perform), plus it makes the code really confusing if there are many variables being passed in. You should use SqlParameters.

public bool Login(string name, string pass){   SqlCommand cmd = new SqlCommand("select * from Account where AccountName=@UID and AccountPassword=@PWD", conn);   cmd.Parameters.Add(new SqlParameter("@UID", name));   cmd.Parameters.Add(new SqlParameter("@PWD", pass));   Object result = cmd.ExecuteScalar();   if (result!= null)      return true;   else      return false;}

See how much cleaner that makes the SQL string look. Now you can even define the string as an constant if you may need to use it elsewhere in you code.

Bill

Afr0m@n

Author

Afr0m@n

Mar 31, 2006 at 2:05 AM

Thanks guys fixed it! :)

Topic Locked

This topic has been locked by a moderator. New replies are not allowed.