VB.NET SQL Statement - sql

Question

I am relatively new to programming in VB.
Currently, I have a login page that works fine. After successful login, my user is directed to another form which connects back into an MS Access table and presents data on the screen for them.
I take the logged in user and equal it to a label on the secondary form (after they login). Basically I want to have a SQL select statement for if the Username column in my access db equals that label, then to pull back the data for that unique user. Here is my current code:
lblUsername.Text = login.txtUsername.Text
DbProvider = "PROVIDER=Microsoft.Jet.OLEDB.4.0;"
DbSource = "Data Source = C:\loginprogram\studentclasslist.mdb"
con.ConnectionString = DbProvider & DbSource
con.Open()
strSQL = "SELECT * FROM Table1 WHERE Username = '" + Label1.Text + "'""
da = New OleDb.OleDbDataAdapter(strSQL, con)
da.Fill(ds, "studentclasslist")
con.Close()
It doesn't work. When I take the where statement out and just do "Select * From Table1" it works fine, but doesn't give me a unique logged in user, which is my goal.
Please help!

Answer 1

You should store your login user id in the session when user logged in successfully.
//In your login page
Session["myUser"] = txtUsername.Text
Then, you can use the user id from Session anywhere in your application.
//In your other page.
Dim Cmd As OleDbCommand = connection.CreateCommand()
Cmd.CommandText = "SELECT * FROM Table1 WHERE Username=?"
Cmd.Parameters.Add("#Username",OleDbType.Text,50).Value = Session["myUser"]
Dim da As New OleDbDataAdapter(Cmd)
Dim dt As New DataTable()
da.Fill(dt)

Answer 2

It din't work because of, misused double quotation.
May be Something like this
lblUsername.Text = login.txtUsername.Text
DbProvider = "PROVIDER=Microsoft.Jet.OLEDB.4.0;"
DbSource = "Data Source = C:\loginprogram\studentclasslist.mdb"
con.ConnectionString = DbProvider & DbSource
con.Open()
strSQL = "SELECT * FROM Table1 WHERE Username = '" & Label1.Text & "'"
da = New OleDb.OleDbDataAdapter(strSQL, con)
da.Fill(ds, "studentclasslist")
con.Close()
But this will leads you to SQL injection attacks. use parameterized queries to treat input as values in your SQL queries.
lblUsername.Text = login.txtUsername.Text
DbProvider = "PROVIDER=Microsoft.Jet.OLEDB.4.0;"
DbSource = "Data Source = C:\loginprogram\studentclasslist.mdb"
con.ConnectionString = DbProvider & DbSource
con.Open()
strSQL = "SELECT * FROM Table1 WHERE Username = #UserName"
da = New OleDb.OleDbDataAdapter(strSQL, con)
da.SelectCommand.Parameters.Add("#UserName",SqlDbType.nvarchar,50).Value = Label1.Text
da.Fill(ds, "studentclasslist")
con.Close()

Answer 3

To prevent from SQL injection as parameters as already been widely suggested. Additionally, you could use Using for you connection to dispose right away the connection after it is being used like:
Using con As New OleDbConnection(DbProvider & DbSource)
con.Open()
strSQL = "SELECT * FROM Table1 WHERE Username = #UserName"
da = New OleDb.OleDbDataAdapter(strSQL, con)
da.SelectCommand.Parameters.Add("#UserName",SqlDbType.nvarchar,50).Value = Label1.Text
da.Fill(ds, "studentclasslist")
End Using
Secondly, you can put the data on a DataTable
Dim dt as new DataTable
dt = ds.Tables(0)
And assuming that you have one record match you could check if there are records by checking Records.Count and if there is save it to a DataRow and then Textboxes.
If (dt.Rows.Count > 0) Then
Dim dr as DataRow = dt.Rows(0)
'Field names and Textbox names below are just mine
txtUserName.Text = dr.Item("Username")
txtPassword.Text = dr.Item("Password")
txtUserlevel.Text = dr.Item("UserLevel")
End If
So, all in all it would probably look like this:
lblUsername.Text = login.txtUsername.Text
DbProvider = "PROVIDER=Microsoft.Jet.OLEDB.4.0;"
DbSource = "Data Source = C:\loginprogram\studentclasslist.mdb"
Using con As New OleDbConnection(DbProvider & DbSource)
Dim dt as new DataTable
con.Open()
strSQL = "SELECT * FROM Table1 WHERE Username = #UserName"
da = New OleDb.OleDbDataAdapter(strSQL, con)
da.SelectCommand.Parameters.Add("#UserName",SqlDbType.nvarchar,50).Value = Label1.Text
da.Fill(ds, "studentclasslist")
dt = ds.Tables(0)
If (dt.Rows.Count > 0) Then
Dim dr as DataRow = dt.Rows(0)
'Field names and Textbox names below are just mine
txtUserName.Text = dr.Item("Username")
txtPassword.Text = dr.Item("Password")
txtUserlevel.Text = dr.Item("UserLevel")
End If
End Using

Answer 4

thanks everyone. it was the double quote. works now but next is making it sql injection proof which i will learn how to use parameterized queries to prevent against.