Question

I’m trying to make an login page.

I have a table for my users which have four columns.

id username password admin

I have one post but i cant log in. Here’s my code:

    try
    {


        string strcon = System.Configuration.ConfigurationManager.ConnectionStrings["blogCS"].ToString();
        SqlConnection myConnection = new SqlConnection();
        myConnection.ConnectionString = strcon;
        myConnection.Open();

        string strSql = "SELECT COUNT(*) FROM users WHERE username=' " + txtUsername + "' AND password='";
        SqlCommand command = new SqlCommand(strSql, myConnection); 
        int count = Convert.ToInt32(command.ExecuteScalar());
        myConnection.Close();

        if (count == 1)
            Response.Redirect("index.aspx");
        else
            lblStatus.Text = Convert.ToString(count);

    }

    catch (Exception k)
    {
        lblStatus.Text = k.Message;
    }

Answer 1

Here is refined Code :

    try
    {


        string strcon = System.Configuration.ConfigurationManager.ConnectionStrings["blogCS"].ToString();
        SqlConnection myConnection = new SqlConnection();
        myConnection.ConnectionString = strcon;
        myConnection.Open();

        string strSql = "SELECT COUNT(id) FROM users WHERE username=' " + txtUsername + "' AND password='" + txtPassword + "'";
        SqlCommand command = new SqlCommand(strSql, myConnection); 
        int count = Convert.ToInt32(command.ExecuteScalar());
        myConnection.Close();

        if (count == 1)
            Response.Redirect("index.aspx");
        else
            lblStatus.Text = Convert.ToString(count);

    }

    catch (Exception k)
    {
        lblStatus.Text = k.Message;
    }