Question

I have a form which goes to the following login script when it is submitted.

<%
    Dim myConnection As System.Data.SqlClient.SqlConnection
    Dim myCommand As System.Data.SqlClient.SqlCommand
    Dim requestName As String
    Dim requestPass As String
    requestName = Request.Form("userName")
    requestPass = Request.Form("userPass")
    Dim queryString As String = "SELECT COUNT(*) AS Num_Of_User FROM tblusers WHERE username='" & requestName & "' AND password='" & requestPass & "'"
    myConnection = New System.Data.SqlClient.SqlConnection("Data Source=(local);InitialCatalog=dbtest;Integrated Security=True")
    myCommand = New System.Data.SqlClient.SqlCommand(queryString, myConnection)
    myConnection.Open()
    Dim reader As System.Data.SqlClient.SqlDataReader = myCommand.ExecuteReader()
%>

Now in theory, I should be able to get that Num_Of_User from the SQL Query and if it equals 1 than the login was successful. Is this the correct way? And how can I get the value that the SQL returns?

Answer 1

Try myCommand.ExecuteScalar(), which returns the value from the first column in the first row of the resultset – exactly the value you’re after here.

Also, check into the ASP.Net ‘built in’ authentication methods – this might save you some effort.