Trying to login on the basis of emald and password stored on my database, But I am getting exceptions. Why?

Question

//This code is of login button
protected void Button1_Click1(object sender, EventArgs e)
        SqlDataReader dr;
        SqlConnection conn = new SqlConnection(GetConnectionString());
        string sql = "SELECT PASSWORD FROM ACCOUNT WHERE EMAILID='"
                    +TextBox1.Text+"'";
        try
        conn.Open();
        SqlCommand cmd = new SqlCommand(sql, conn);
        dr = cmd.ExecuteReader();
            if (dr[0].ToString() == TextBox2.Text)
                Response.Redirect("http://www.microsoft.com");
            else
                Label1.Text = "Wrong Details!";
        catch
            Label1.Text = "Error!";
        //finally
        //    conn.Close();
//Please Help me! Thanks.
KGProgrammer

Answer 1

     SqlConnection conn = new SqlConnection(GetConnectionString());
        string sql = "SELECT PASSWORD FROM ACCOUNT WHERE EMAILID='"
                    +TextBox1.Text+"'";
Hello,
Based on your code, you may have a SQL injection vulnerability. You can try to use parameterized query that assign user input to a parameter instead of embedding user input in the query statement.For example:
Using(SqlCommand cmd = new SqlCommand("SELECT * FROM ACCOUNT WHERE emailid = @id AND password = @pw",conn))
cmd.Parameters.AddWithValue("@id",TextBox1.Text);
cmd.Parameters.AddWithValue("@pw",TextBox2.Text);
SqlDataReader dr = cmd.ExecuteReader();
If(dr.HasRows)
Response.Redirect("http://www.microsoft.com");
else
Label1.Text = "Wrong Details!";
The following thread is about a similar requirement, please refer to:
http://stackoverflow.com/questions/16618212/c-sharp-database-log-in-form
Regards,
Fanny Liu
Fanny Liu
TechNet Community Support