Click here to Skip to main content
16,006,006 members
Home / Discussions / C#
   

C#

 
GeneralRe: Checking If Form Is Loaded Pin
Brian Nottingham6-Oct-04 12:57
Brian Nottingham6-Oct-04 12:57 
GeneralMAPI programming by C# Pin
ppp0016-Oct-04 5:53
ppp0016-Oct-04 5:53 
GeneralRe: MAPI programming by C# Pin
Heath Stewart6-Oct-04 13:40
protectorHeath Stewart6-Oct-04 13:40 
GeneralKeyboard question Pin
Jose Vicente6-Oct-04 5:28
Jose Vicente6-Oct-04 5:28 
GeneralRe: Keyboard question Pin
Alex Korchemniy6-Oct-04 8:10
Alex Korchemniy6-Oct-04 8:10 
GeneralRe: Keyboard question Pin
Jose Vicente6-Oct-04 21:10
Jose Vicente6-Oct-04 21:10 
GeneralRecieving error: unhandled exception... Pin
Moochie56-Oct-04 5:12
Moochie56-Oct-04 5:12 
GeneralRe: Recieving error: unhandled exception... Pin
Heath Stewart6-Oct-04 13:36
protectorHeath Stewart6-Oct-04 13:36 
The problem you're having is that Username is a string field, so you need to quote your field:
"SELECT Username, Password FROM tblLogin WHERE Username = '" + txtUIserName.Text + "'"
BUT NEVER, EVER build SQL expressions using concatenation.

Sorry, but that isn't very smart at all. What if I pass "blah' AND 1=1; drop table tblLogin" from your TextBox? Bye bye login table. It's even worse that you store passwords in plain text. I could, instead, select all those and impersonate any user on your system. Can you say "lawsuits"?

Read http://www.codeproject.com/script/comments/forums.asp?msg=932507&forumid=1649&XtraIDs=1649&searchkw=parameterized&sd=7%2F8%2F2004&ed=10%2F6%2F2004#xx932507xx[^] for other problems and more things I could do using your SQL concatenation code.

ALWAYS use parameterized queries. Read the link above for an example, or the OleDbParameter class documentation in the .NET Framework SDK.

Also, your expression is very insecure besides not using parameterized queries. Don't select the password as part of the result set. Send the password and use it in the WHERE clause like so:
SELECT COUNT(*) FROM tblLogin WHERE Username = ? AND Password = ?
In fact, even that's bad. You should never store passwords in plain text. Hash them using a one-way algorithm like MD5 or SHA1, both of which are supported by the .NET Framework base class libraries (see the MD5 and SHA1 class). Hash the password before sending it to the database server (and I assume this is actually for an ASP.NET application, which belongs in the ASP.NET forum but I'll continue anyway) or across the wire, then compare that to the hash you store in the Password field (using the same query as above).

In fact, even that's insecure. It's subject to replay attacks where someone sniffs your password and while they might not be able to unhash or decrypt it (at least with a given amount of time and resources), they could simply capture the packets, play them back, and you've been 0wned. Instead, store a salt, send it to the client, hash your password + the salt value and send it back to the server.

You should really read many of the good security Patterns and Practices books regarding .NET at http://msdn.microsoft.com/patterns[^].

This posting is provided "AS IS" with no warranties, and confers no rights.

Software Design Engineer
Developer Division Sustained Engineering
Microsoft

[My Articles]
QuestionRecord install path? Pin
the last free name6-Oct-04 4:50
the last free name6-Oct-04 4:50 
AnswerRe: Record install path? Pin
Heath Stewart6-Oct-04 13:25
protectorHeath Stewart6-Oct-04 13:25 
GeneralPanel control in a DLL Pin
Reinier van de Wetering6-Oct-04 4:48
Reinier van de Wetering6-Oct-04 4:48 
GeneralRe: Panel control in a DLL Pin
Jon G6-Oct-04 5:06
Jon G6-Oct-04 5:06 
GeneralRe: Panel control in a DLL Pin
Reinier van de Wetering6-Oct-04 19:47
Reinier van de Wetering6-Oct-04 19:47 
Generaldisplaying nested tables Pin
njaromack6-Oct-04 4:34
njaromack6-Oct-04 4:34 
GeneralRe: displaying nested tables Pin
njaromack6-Oct-04 10:36
njaromack6-Oct-04 10:36 
GeneralRe: displaying nested tables Pin
Heath Stewart6-Oct-04 13:16
protectorHeath Stewart6-Oct-04 13:16 
GeneralChange windows service logon account and password using c# Pin
Subin KJ6-Oct-04 4:31
Subin KJ6-Oct-04 4:31 
GeneralRe: Change windows service logon account and password using c# Pin
Heath Stewart6-Oct-04 12:57
protectorHeath Stewart6-Oct-04 12:57 
GeneralLogin Pin
pat2708816-Oct-04 4:31
pat2708816-Oct-04 4:31 
GeneralRe: Login Pin
Heath Stewart6-Oct-04 12:34
protectorHeath Stewart6-Oct-04 12:34 
GeneralRe: Login Pin
pat2708817-Oct-04 7:38
pat2708817-Oct-04 7:38 
GeneralRe: Login Pin
pat2708817-Oct-04 7:43
pat2708817-Oct-04 7:43 
Generalsetting datagrid cursors Pin
ddelapasse6-Oct-04 4:01
ddelapasse6-Oct-04 4:01 
Question.NET OLAP control? Pin
jvbragt6-Oct-04 2:29
jvbragt6-Oct-04 2:29 
AnswerRe: .NET OLAP control? Pin
Christian Wikander6-Oct-04 3:36
Christian Wikander6-Oct-04 3:36 

General General    News News    Suggestion Suggestion    Question Question    Bug Bug    Answer Answer    Joke Joke    Praise Praise    Rant Rant    Admin Admin   

Use Ctrl+Left/Right to switch messages, Ctrl+Up/Down to switch threads, Ctrl+Shift+Left/Right to switch pages.