Question

I have troubles preparing a query with 2 parameters in VB.NET.

This is my code:

Dim username As String = loginUsername.Value
Dim password As String = EncryptMD5standard(loginPassword.Value)
Dim valid As Boolean = False
Dim connectionString As String = ConfigurationManager.ConnectionStrings("myConnectionString").ConnectionString
        Dim queryString As String = "SELECT id, user_name, role FROM users WHERE user_name = '@user' AND paswd = '@pass'"
        Dim ds As New DataSet()
        Try
            Using connection As New SqlConnection(connectionString)
                Dim command As New SqlCommand(queryString, connection)
                connection.Open()
                command.CommandText = queryString
                command.Parameters.Add("@user", SqlDbType.NVarChar, 15).Value = username
                command.Parameters.Add("@pass", SqlDbType.NVarChar, 32).Value = password
                Dim adapter As New SqlDataAdapter()
                adapter.SelectCommand = command

                adapter.Fill(ds, "login")
                If ds.Tables("login").Rows.Count > 0 Then
                    valid = True
                End If
            End Using
        Catch ex As Exception
            errorLabel.Text = DirectCast(GetLocalResourceObject("erroreDB"), String) & ": " & ex.ToString
        End Try

But, by doing this my valid value is always “false”, so it fails the row count.
I used some debug and looks like my table login inside ds is empty.
Query works, I tried it manually in SQLServer replacing parameters and I can’t understand why I have empty results.

What I’m doing wrong?.

Answer 1

You don’t need to wrap your parameters in single quotes, as the parameter system takes care of that.