Member Avatar for Benyam 
public partial class Form4 : Form
{
    private OleDbConnection connect = new OleDbConnection();


    public Form4()
    {
        InitializeComponent();
        connect.ConnectionString = @"Provider=Microsoft.ACE.OLEDB.12.0;Data Source=C:\Users\Bino Unity\Desktop\user1.accdb;Persist Security Info=False;";
    }

    private void Form4_Load(object sender, EventArgs e)
    {

    }

    private void login_button_Click(object sender, EventArgs e)
    {
        connect.Open();
        OleDbCommand command = new OleDbCommand();
        command.Connection = connect;
        command.CommandText =@"select * from log where User Name='"+textBox1.Text+"' and Password='"+textBox2.Text+"'";   
       OleDbDataReader reader =  command.ExecuteReader();
       int count = 0;
        while(reader.Read())
        {
            count = count+1;
        }
        if(count ==1)
        {
            MessageBox.Show("username and password is correct");
        }
        if(count >1)
        {
            MessageBox.Show("Duplicate username and password...Access Denied");
        }
        else
        {
            MessageBox.Show("username and password incorrect");
        }
        connect.Close();

        Form2 form = new Form2();
        form.ShowDialog(this);
    }


}
}​
  • 3 Contributors
  • 2 Replies
  • 281 Views
  • 18 Hours Discussion Span
  • Latest Post Latest Post by JerrimePatient

Dani AI

Generated

The error is coming from the SQL parser choking on your identifiers and on how the SQL is being built. and are correct that identifiers with spaces (and ambiguous names like Password) must be delimited or renamed, but there are a few more issues to fix for correctness and safety: string concatenation (SQL injection risk), the if/else logic that can produce two messages, and resource handling (opening/closing connections).

A safer, clearer approach is to use a parameterized COUNT(*) query and proper using blocks. For Access/OleDb you typically use positional ? parameters, so parameter order matters:

using (var conn = new OleDbConnection(connString))
{
    conn.Open();
    using (var cmd = conn.CreateCommand())
    {
        cmd.CommandText = "SELECT COUNT(*) FROM [log] WHERE [User Name]=? AND [Password]=?";
        cmd.Parameters.AddWithValue("user", textBox1.Text.Trim());
        cmd.Parameters.AddWithValue("pwd", textBox2.Text);
        int count = Convert.ToInt32(cmd.ExecuteScalar());

        if (count == 1)
            MessageBox.Show("username and password are correct");
        else if (count > 1)
            MessageBox.Show("Duplicate username and password...Access Denied");
        else
            MessageBox.Show("username and password incorrect");
    }
}

Notes and checks specific to this thread

  • Use square brackets or rename columns/table to avoid spaces/reserved-word ambiguity.
  • For OleDb the ? placeholders are positional; AddWithValue names are ignored by the provider—keep parameter ordering correct or create explicit OleDbParameter objects with types.
  • Replace the reader loop/count with ExecuteScalar() for a single-count check (faster, simpler).
  • Fix the branching: use else if so you don't show both “correct” and “incorrect” messages.
  • Security: never store passwords in plaintext — use a salted, slow hash (PBKDF2/bcrypt/Argon2) and compare hashes, and always validate/trim inputs before querying.

Follow those steps and the syntax error will be resolved and the code will be safer and more predictable.

Recommended Answers

All 2 Replies

Member Avatar for djjeavons

Hi

Your table is using field names with both spaces and potentially reserved words (password). So you will need to enclose both of these within square brackets (or rename the fields in the table).

command.CommandText = "select * from log where [User Name]='"+textBox1.Text+"' and [Password]='"+textBox2.Text+"'";

HTH

Member Avatar for JerrimePatient

line 22:

command.CommandText =@"select * from log where User Name='"+textBox1.Text+"' and Password='"+textBox2.Text+"'";

change in to:

command.CommandText ="select * from log where [User Name]='"+textBox1.Text+"' and Password='"+textBox2.Text+"'";
Be a part of the DaniWeb community

We're a friendly, industry-focused community of developers, IT pros, digital marketers, and technology enthusiasts meeting, networking, learning, and sharing knowledge.