Imports System.Data
Imports System.Data.OleDb
Public Class LoginForm
Dim StrConn As String
Dim Conn As New OleDbConnection
Dim da As OleDbDataAdapter
Dim ds As New DataSet
Dim dt As DataTable
Dim dr As DataRow
Dim CurrentEmployees As Integer
Dim IsFind As Boolean = False
Dim btnChk As String
Dim Cnn As New OleDbConnection(Cnnstring)
Dim Cnnstring As String
Dim SqlSelect As String
Dim OleReader As OleDbDataReader
Dim UserIDA As String
Dim PassIDA As String
Private Sub LoginForm_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
StrConn = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source=C:\Documents and Settings\Administrator\Desktop\ae\LibralyProject\libraly.accdb"
With Conn
If .State = ConnectionState.Open Then Close()
.ConnectionString = StrConn
.Open()
End With
End Sub
Private Sub OK_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles OK.Click
If txtUserName.Text = "" Then
MessageBox.Show("ใส่ข้อมูล", "No UserID", MessageBoxButtons.OK, MessageBoxIcon.Error)
Else
ReadMyData(Cnnstring)
End If
End Sub
Public Sub ReadMyData(ByVal myConnString As String)
SqlSelect = "select * from users Where userid = " & txtUserName.Text & "userpassword = " & txtPwd.Text & "'"
Dim OleCommand As New OleDbCommand(SqlSelect, Conn)
[font=Verdana] OleReader = OleCommand.ExecuteReader[/font]
OleReader.Read()
UserIDA = OleReader.Item("userid")
PassIDA = OleReader.Item("userpassword")
If txtUserName.Text = UserIDA And txtPwd.Text = PassIDA Then
Form2.Show()
txtUserName.Text = ""
txtPwd.Text = ""
Me.Hide()
Else
MessageBox.Show("กรุณาใส่ข้อมูลให้ถูกต้อง", Me.Text, MessageBoxButtons.OK, MessageBoxIcon.Warning)
End If
End Sub
Private Sub Cancel_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Cancel.Click
Me.Close()
End Sub
End Class
SqlSelect = "select * from users Where userid = " & txtUserName.Text & "userpassword = " & txtPwd.Text & "'"
แก้ให้
Code (VB.NET)
SqlSelect = "select * from [users] Where [userid] = '" & txtUserName.Text & "' and [userpassword] = '" & txtPwd.Text & "'"
แต่ให้ดีเปลี่ยนไปใช้แบบ parameter จะดีกว่านะ
Code (VB.NET)
SqlSelect = "select * from [users[ Where [userid] = @userid and [userpassword] = @userpassword"
Dim OleCommand As New OleDbCommand(SqlSelect, Conn)
OleCommand.Parameters.AddWithValue("@userid", txtUserName.Text)
OleCommand.Parameters.AddWithValue("@userpassword", txtPwd.Text)