Validate username and password in Microsoft VIsual Studio - vb.net

Question

I am having trouble validating a username and password when someone clicks a button. I have two text boxes named user_logon_id and user_password.
I have a table called MyUsers that I suppose to verify that both the username (user_logon_id) and password (user_password) are in the same row. If they do not match, it's supposed to notify the user. If it does match then direct them to userAdmin.aspx.
I am using Microsoft Visual Studio 2008. I am really new to this and would really like to get a grasp on this. I do not need to worry about encrypting the password.

Answer 1

Can you run this in the debugger and verify that the query is returning a row?
Some suggestions:
Consider parameterizing your query like this:
Dim conn As New SqlConnection(_connectionString)
conn.Open()
Dim s As String = "SELECT user_password FROM MyUsers WHERE user_logon_id = #user_login_id"
Dim cmd As New SqlCommand(s)
cmd.Parameters.Add("#user_login_id", Me.user_logon_id.Text)
Dim reader As SqlDataReader = cmd.ExecuteReader()
Hash the password in some way
Consider selecting from the database table where the username and password match. If the result is one record the login succeeded.
Dim s As String = "SELECT userid FROM MyUsers WHERE user_logon_id = #user_login_id and user_password=#user_password"
Full code
Protected Sub butSubmit_Click(ByVal sender As Object, ByVal e As System.EventArgs) Handles butSubmit.Click
Dim myReader As Data.SqlClient.SqlDataReader
Dim mySqlConnection As Data.SqlClient.SqlConnection
Dim mySqlCommand As Data.SqlClient.SqlCommand
'Establish the SqlConnection by using the configuration manager to get the connection string in our web.config file.
mySqlConnection = New Data.SqlClient.SqlConnection(ConfigurationManager.ConnectionStrings("ConnectionString1").ToString())
Dim sql As String = "SELECT userid FROM MyUsers WHERE user_logon_id = #user_login_id and user_password=#user_password"
mySqlCommand = New Data.SqlClient.SqlCommand(sql, mySqlConnection)
cmd.Parameters.Add("#user_login_id", Me.user_logon_id.Text)
cmd.Parameters.Add("#user_password", Me.user_password.Text)
Try
mySqlConnection.Open()
myReader = mySqlCommand.ExecuteReader()
If (myReader.HasRows) Then
'Open page with users and roles
Dim message As String = "Correct password"
Dim style As MsgBoxStyle = MsgBoxStyle.OkOnly
Dim title As String = "Authenticated"
MsgBox(message, style, title)
End If
Catch ex As Exception
Console.WriteLine(ex.ToString())
Finally
If Not (myReader Is Nothing) Then
myReader.Close()
End If
If (mySqlConnection.State = Data.ConnectionState.Open) Then
mySqlConnection.Close()
End If
End Try
End Sub