Question

I have a website with a login, from a database.

This is my code :

        protected void SignIn_Click(object sender, EventArgs e)
        {
            SqlConnection con = new SqlConnection("Data Source=MICROSOF-58B8A5\\SQL_SERVER_R2;Initial Catalog=Movie;Integrated Security=True");
            con.Open();

            string cmdStr = "select count(*) from Users";

            cmdStr += "where Username='" + UsernameSignIn.Text + "'";
            cmdStr+= "AND Password='"+PasswordSignIn.Text+"'";

            SqlCommand cmd = new SqlCommand(cmdStr, con);

            int i = Convert.ToInt16(cmd.ExecuteScalar());

            if (i == 0)
            {
                ErrorSignIn.Text = "Sorry, Wrong Username or Password";
            }
            else
            {
                Response.Redirect("HomeAfter.aspx");
            }
        }

for some reason, I run into an error :

Incorrect syntax near ‘-‘

.
(for this line : int i = Convert.ToInt16(cmd.ExecuteScalar()); )

Thanks,

Answer 1

There is no spacing. Your query looks like this:

select count(*) from Userswhere Username=’…’AND Password=’…’

Add spaces, like so:

string cmdStr = "select count(*) from Users";
cmdStr += " where Username='" + UsernameSignIn.Text + "'";
cmdStr+= " AND Password='"+PasswordSignIn.Text+"'";