Username and password validation

[kipslem]

Hello,

I'm a newbie to VB.Net and I need an urgent help as I'm developing an application using the VB.Net.

I have a form just like the login form in VB.Net. The usernames are prepopulated on a combobox with datas from the SQL DB backend, and the text box for the password entry is empty. My code is working but what I need help is, for the code to validate the username and password entered against that stored on the SQL DB backend. Like when the user selectes a wrong username but the password entered is correct, there shld be a messagebox like "The username selected is wrong", or if the username is correct and the password entered is wrong then the msg is "The password entered is not correct, please type you password using the right case". My code below as I have said is working but I'm confues as to where I can writer the If....Else statements. Please need an urgent help.

Try
            conn.Open()
            Dim SelectStm As String = "SELECT * FROM tblStaff WHERE UserName = @UserName AND Password = @Password"
            Dim objCmd As SqlCommand = New SqlCommand(SelectStm, conn)
            objCmd.Parameters.AddWithValue("@UserName", cmbUserName.Text)
            objCmd.Parameters.AddWithValue("@Password", Trim(txtPassword.Text))

            Dim objAdpt As SqlDataAdapter = New SqlDataAdapter(objCmd)

            Dim objDt As DataTable = New DataTable()
            objAdpt.Fill(objDt)

            If objDt.Rows.Count > 0 Then
                'If user is found, then show the following
                Me.grpAttendenceCheck.Visible = True
                Me.grpAttendenceCheck.Size = New System.Drawing.Size(510, 157)
                Me.grpPrintTime.Visible = False

            Else
                
                MessageBox.Show("Please enter your right username and password")


            End If
            conn.Close()

        Catch ex As Exception
            MessageBox.Show("Failure")

        End Try

[adarshcu]

Do not allow the user the option to enter his own username in the combobox. Disable that option. This ensures that the username will always be a valid one. No row count will then indicate that the password entered for that username is wrong. I hope you get my point.

[kipslem]

Do not allow the user the option to enter his own username in the combobox. Disable that option. This ensures that the username will always be a valid one. No row count will then indicate that the password entered for that username is wrong. I hope you get my point.

Thanks adarshcu,

Actually my applications is a Attendance system and that it will make easy for the users to just select their right username and then enter the password, instead of them typing the whole username and password creating a long queue for the people to wait for clockin. I have put the username because it is captured at the Attendance table at the SQL backend for reporting, and the password so that no one clocks in for any other person except for him/herself. SO with advise from you, would it be possible for me to just validate the password and then update the Attendance table with the username if password is correct? What if the user mistakenly chose the wrong username if it is not validated? Please need you help?

Thanks.

[adarshcu]

My point is how do you know a person has selected a wrong username. A person would select a username and a corresponding password and not a corresponding username for a password. Also since you are pre-populating the usernames , there is no point of the user selecting a username that does not exist right .?? So , You'l have to go ahead considering that a user must at least select a proper username from the list of them. Any other suggestions or options are welcome.

[kipslem]

My point is how do you know a person has selected a wrong username. A person would select a username and a corresponding password and not a corresponding username for a password. Also since you are pre-populating the usernames , there is no point of the user selecting a username that does not exist right .?? So , You'l have to go ahead considering that a user must at least select a proper username from the list of them. Any other suggestions or options are welcome.

Thanks adarshcu,

I got what you are saying. So do I just change the codes above to validate the password and not the username? Then How do I know that the user has selected the right username from the combobox as my Attendnace Table at the SQL backend has to be updated that has the usernames as well?

[adarshcu]

Yes. I think you have already validated the password. The user will select a username that is existing in the database . If the password matches the password for that username a record is retrieved or else a message is popped. I think u had the full code. Displaying the username in a combo-box helps in self-validation of the username. Additionally u can print out a more appropriate pop up message saying "The password does not match for the username selected , Please ensure that they are correct."

[kipslem]

Yes. I think you have already validated the password. The user will select a username that is existing in the database . If the password matches the password for that username a record is retrieved or else a message is popped. I think u had the full code. Displaying the username in a combo-box helps in self-validation of the username. Additionally u can print out a more appropriate pop up message saying "The password does not match for the username selected , Please ensure that they are correct."

Thanks for all these. I'll make changes to the codes as per your advice.