How to have restriction in comparing textbox value? - vb.net

Question

Private Sub txtuser_LostFocus(ByVal sender As Object, ByVal e As System.EventArgs) Handles txtuser.LostFocus
Try
con.Open()
adapter.Fill(table)
sql = "Select * from login "
command = New MySqlCommand(sql, con)
myreader = command.ExecuteReader
Dim a As Integer
Dim b As Integer
a = table.Rows.Count
a -= 1
b = 0
If table.Rows.Count > 0 Then
While (b <= a)
If txtuser.Text = table.Rows(b).Item("username") Then
usercons.Visible = True
PictureBox1.Visible = False
txtuser.Text = ""
btnsave.Enabled = False
ElseIf Not txtuser.Text = table.Rows(b).Item("username") Then
usercons.Visible = False
PictureBox1.Visible = True
btnsave.Enabled = False
End If
b += 1
End While
End If
Catch ex As MySqlException
MsgBox("An Error Occurred. " & ex.Number & " – " & ex.Message)
End Try
con.Close()
End Sub

Answer 1

This is the quick but highly dangerous way of doing it open to all sorts of abuse:
sql = "Select * from login WHERE username='" & txtuser.Text & "'
There is a better way, create a parameter:
con.Open()
adapter.Fill(table)
sql = "Select * from login WHERE username=#username"
command = New MySqlCommand(sql, con)
Dim param As New SqlParameter("#username", SqlDbType.VarChar)
command.Parameters.Add(param)
myreader = command.ExecuteReader
Then check the Rows property, if more than 0 rows, you have selected the user.