Question

I’m making a login form in VB.NET, and I have a table in mysql called user. What I want to do is before a user can login the Administrator column of the user table must be TRUE and the DELETED column must be FALSE. I’ve tried everything I know but all non admin users are still able to login…

Heres how the user table looks like:

+---------------+------------+---------+--------+---------+----------+---------------+---------+
| User_BannerID | FirstName | LastName | Email | Username | Password | Administrator | Deleted |
+---------------+------------+---------+--------+---------+----------+---------------+---------+
|               |            |         |        |         |          |               |         |
|               |            |         |        |         |          |               |         |
+---------------+------------+---------+--------+---------+----------+---------------+---------+

here’s the code:

Imports MySql.Data.MySqlClient
Public Class frmAdlogin

    Private Sub cmdCancel_Click(sender As System.Object, e As System.EventArgs) Handles cmdCancel.Click
        Application.Exit()
    End Sub

    Private Sub cmdLogin_Click(sender As System.Object, e As System.EventArgs) Handles cmdLogin.Click
        Dim conn As New MySqlConnection
        Dim myCommand As New MySqlCommand

        Dim myConnString As String
        Dim UserID As String

        myConnString = "server=" & txtServer.Text & ";" _
  & "user id=" & txtUsername.Text & ";" _
  & "password=" & txtPassword.Text & ";" _
  & "database=attendance"

        conn.ConnectionString = myConnString

        Try
            conn.Open()

            myCommand.Connection = conn
            myCommand.CommandText = "SELECT user_bannerid FROM user WHERE BINARY username = ?Username and administrator = 'TRUE' and deleted = 'FALSE' "
            myCommand.Parameters.Add("?Username", txtUsername.Text)

            UserID = myCommand.ExecuteScalar

            conn.Close()

            Dim AdminForm As New frmAdmin
            AdminForm.UserID = UserID
            AdminForm.connectionString = myConnString
           AdminForm.Show()

            Me.Hide()
            Me.Close()
        Catch myerror As MySqlException
            MessageBox.Show("Invalid login. Please Enter The Correct Server Address And Your Username Plus The Correct Password ")
            conn.Dispose()
        End Try
    End Sub
    Private Sub frmAdlogin_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
        Me.AcceptButton = cmdLogin
        Me.CancelButton = cmdCancel
        txtPassword.PasswordChar = "*"
    End Sub
End Class

EDIT BizApps heres how it looks now:

Imports MySql.Data.MySqlClient
Public Class frmAdlogin

    Private Sub cmdCancel_Click(sender As System.Object, e As System.EventArgs) Handles cmdCancel.Click
        Application.Exit()
    End Sub

    Private Sub cmdLogin_Click(sender As System.Object, e As System.EventArgs) Handles cmdLogin.Click
        Dim conn As New MySqlConnection
        Dim myCommand As New MySqlCommand

        Dim myConnString As String
        Dim UserID As String

        myConnString = "server=" & txtServer.Text & ";" _
  & "user id=" & txtUsername.Text & ";" _
  & "password=" & txtPassword.Text & ";" _
  & "database=attendance"

        conn.ConnectionString = myConnString


        conn.Open()

        myCommand.Connection = conn
        myCommand.CommandText = "SELECT user_bannerid FROM user WHERE BINARY username = ?Username and administrator = 'TRUE' and deleted = 'FALSE' "
        myCommand.Parameters.Add("?Username", txtUsername.Text)
        Dim dt = New DataTable()
        Dim ds = New MySqlDataAdapter(myCommand)

        ds.Fill(dt)

        If (dt.Rows.Count > 0) Then

            conn.Close()

            Dim AdminForm As New frmAdmin
            AdminForm.UserID = UserID
            AdminForm.connectionString = myConnString
            AdminForm.Show()

            Me.Hide()
            Me.Close()
        Else
            MessageBox.Show("Invalid login. Please Enter The Correct Server Address And Your Username Plus The Correct Password ")
        End If

    End Sub
    Private Sub frmAdlogin_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
        Me.AcceptButton = cmdLogin
        Me.CancelButton = cmdCancel
        txtPassword.PasswordChar = "*"
    End Sub
End Class

Answer 1

First try your query if its working.

 SELECT user_bannerid FROM user WHERE BINARY username ='myusername' and administrator = 'TRUE' and deleted = 'FALSE'

Then if it returns records

Try this:

 myCommand.Connection = conn
        myCommand.CommandText = "SELECT user_bannerid FROM user WHERE BINARY username = ?Username and administrator = 'TRUE' and deleted = 'FALSE' "
        myCommand.Parameters.Add("?Username", txtUsername.Text)
        Dim dt = new DataTable()
        Dim ds =  New MySqlDataAdapter(myCommand)

       ds.Fill(dt)

       if(dt.Rows.Count < 1 ) then   // no record found

MessageBox.Show("Invalid login. Please Enter The Correct Server Address And Your Username Plus The Correct Password ")

       Else       //record found

       conn.Close()

        Dim AdminForm As New frmAdmin
        AdminForm.UserID = UserID
        AdminForm.connectionString = myConnString
       AdminForm.Show()

        Me.Hide()
        Me.Close()

       End If

Regards