Password validation in vb

Question

karthiyayiniyp 7 Newbie Poster

15 Years Ago

hi ,

i given code for password validation which retrieve the data from oracle table.... it was validating the first record alone... its not validating the next records... help me to validate ...

...............

Option Explicit
Dim ac As New ADODB.Connection
Dim rs As New ADODB.Recordset



Private Sub Command1_Click()

If rs.Fields(0) = Text1.Text And rs.Fields(1) = Text2.Text Then
nsgbox " password is correct"
Form2.Show
End If

End Sub

Private Sub Form_Load()
ac.Open "Provider=MSDASQL.1;Password=tiger;Persist Security Info=True;User ID=scott;Data Source=yp"
rs.Open "select * from demo", ac, adOpenDynamic, adLockOptimistic, -1
End Sub

oracle

Edited 13 Years Ago by mike_2000_17 because: Fixed formatting

5 Contributors
9 Replies
570 Views
1 Day Discussion Span
Latest Post 15 Years Ago Latest Post by debasisdas

Dani AI

Generated 10 Months Ago

Short expert note: the symptom — the code only validated the first row — comes from keeping a table-wide recordset open at Form_Load and then checking the recordset’s current row inside Command1_Click. Replies in this thread steered toward three patterns: loop the recordset (), let the database answer with a single-row/count query (), or open a filtered recordset for the supplied username (, ). Filtering or asking the DB to check is the right approach; looping every row is unnecessary and slower.

Prefer a parameterized lookup that retrieves exactly what’s needed and prevents SQL injection. Fetch the stored credential (ideally a salted hash) for the supplied username, then compare in code. Example pattern (VB6 + ADO):

Dim cmd As ADODB.Command
Dim rs As ADODB.Recordset

Set cmd = New ADODB.Command
Set cmd.ActiveConnection = ac
cmd.CommandText = "SELECT password_hash, salt FROM demo WHERE username = ?"
cmd.CommandType = adCmdText
cmd.Parameters.Append cmd.CreateParameter("p_user", adVarChar, adParamInput, 100, Trim$(Text1.Text))

Set rs = cmd.Execute
If rs.EOF Then
  MsgBox "Username not found"
Else
  If HashPassword$(Trim$(Text2.Text), rs!salt) = rs!password_hash Then
    Me.Hide
    Form2.Show
  Else
    MsgBox "Invalid password"
  End If
End If

rs.Close
Set rs = Nothing: Set cmd = Nothing

Troubleshooting and gotchas: do not rely on RecordCount with forward-only cursors (it can return -1); use rs.EOF/rs.BOF to test emptiness. Close any open recordset before reopening to avoid errors (as warned). Avoid Val() unless the fields are numeric — usernames are usually text. Normalize case explicitly (use UPPER(...) in SQL or normalize inputs) because Oracle string equality is case-sensitive by default.

Security reminders: never store plaintext passwords. Use per-user salts and a strong hash (or a modern KDF) and compare hashes. Logging failed attempts and handling DB/connection errors gracefully will make the login flow robust. Congratulations to for resolving the original problem; the above changes will make the solution safer and more reliable.

All 9 Replies

monarchmk 24 Junior Poster in Training

15 Years Ago

In command1_click do a FOR loop until rs.EOF()

or

open recordset in command1_click event and in SQL syntax check for password and username but beware of SQL Injection

debasisdas 580 Posting Genius

15 Years Ago

try this sample

select count(*) from demo where user_name = u_name and password = pwd

if this SQL returns 1 log in successful and proceed further
else
re-prompt for username / password.

No need of any looping or checking for EOF.

Jx_Man 987 Nearly a Senior Poster

15 Years Ago

see if this help :

Option Explicit
Dim ac As New ADODB.Connection
Dim rs As New ADODB.Recordset

Private Sub Command1_Click()
Set rs = Nothing
rs.Open "select * from demo", ac, adOpenDynamic, adLockOptimistic, -1
If rs!UserName = Text1.Text Then ' modified as your user name field name
    If !rs.Password = Text2.Text Then ' modified as your password field name
        MsgBox " password is correct"
        Form2.Show
    Else
        MsgBox " wrong password "
    End If
Else
     MsgBox " user name unregistered "
End If

End Sub

Private Sub Form_Load()
ac.Open "Provider=MSDASQL.1;Password=tiger;Persist Security Info=True;User ID=scott;Data Source=yp"
End Sub

Edited 15 Years Ago by Jx_Man because: add comments

dnk commented: so nice!! +4

Reply to this topic

Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.

trilok31 8 Newbie Poster · Answer 1 · 2011-03-23T16:50:04+00:00

i modified your code for work correctly but i dont know you field name so im putting here username and password you can change these with yours one

..............

Option Explicit
Dim ac As New ADODB.Connection
Dim rs As New ADODB.Recordset



Private Sub Command1_Click()
if rs.state=adstateopen then rs.close
rs.Open "select * from demo where username='" & text1.text & "'", ac, adOpenDynamic, adLockOptimistic, -1
if rs.recordcount=1 then
if rs!password=text2.text then
nsgbox " password is correct"
Form2.Show
else
msgbox "Invalid Password"

endif
else
msgbox "Username Not Found"
End If

End Sub

Private Sub Form_Load()
ac.Open "Provider=MSDASQL.1;Password=tiger;Persist Security Info=True;User ID=scott;Data Source=yp"

End Sub

trilok31 8 Newbie Poster · Answer 2 · 2011-03-23T17:11:47+00:00

Jx_Man if you open recordset in command click event it should be first check its open or closed then first close it and then open it. other wise u can open a recordset once its already open if user click command button more than once it will get error.

debasisdas 580 Posting Genius Featured Poster · Answer 3 · 2011-03-23T17:57:44+00:00

debasisdas 580 Posting Genius

15 Years Ago

Read line #6 of Jx_Man's code

Edited 15 Years Ago by debasisdas because: n/a

trilok31 8 Newbie Poster · Answer 4 · 2011-03-23T18:10:43+00:00

trilok31 8 Newbie Poster

15 Years Ago

oops i missed that sorry....

karthiyayiniyp 7 Newbie Poster · Answer 5 · 2011-03-23T20:31:25+00:00

thanks for all for your valuable replies.....
i myself solved the problem ... it's working fine .... i attach my code here....

Option Explicit
Dim ac As New ADODB.Connection
Dim rs As New ADODB.Recordset

Dim ac1 As New ADODB.Connection
Dim rs1 As New ADODB.Recordset

Private Sub Command1_Click()

 ac1.Open "Provider=MSDASQL.1;Password=tiger;Persist Security Info=True;User ID=scott;Data Source=yp"
 rs1.Open "select * from demo where username= " & "'" & Text1.Text & "'", ac1, adOpenDynamic, adLockOptimistic
 
 If rs1.BOF = False Then
 If Val(rs1.Fields(0)) = Val(Text1.Text) And Val(rs1.Fields(1)) = Val(Text2.Text) Then
 rs1.MoveNext
 MsgBox "valib"
 Me.Hide
 Form2.Show
 End If
 ElseIf rs1.BOF = True Then
 MsgBox "invalid"
 End If
 ac1.Close
 End Sub

Private Sub Form_Load()

ac.Open "Provider=MSDASQL.1;Password=tiger;Persist Security Info=True;User ID=scott;Data Source=yp"
rs.Open "select * from demo", ac, adOpenDynamic, adLockOptimistic, -1

End Sub

debasisdas 580 Posting Genius Featured Poster · Answer 6 · 2011-03-24T02:48:24+00:00

debasisdas 580 Posting Genius

15 Years Ago

Happy to learn your issue is solved.

Happy coding. :)

Password validation in vb

Dani AI

Recommended Answers Collapse Answers

All 9 Replies

Recommended Answers