How to get data in ASP.net MVC

Question

I'm trying to get the IsAdmin Value with SQL query(This query return 1 line or 0). but i get this error {"invalide reading Tentative there are no any data present."} This is my code

        public static bool Login (string iduser, string password, bool IsAdmin)
    {
        bool auth = false;
        string query = string.Format("Select IsAdmin from [user] where iduser = '{0}' AND mdp = '{1}' ;", iduser, password);
        SqlCommand cmd = new SqlCommand(query, con);
        con.Open();
        SqlDataReader re = cmd.ExecuteReader();
        auth = re.HasRows;
        if (auth) { IsAdmin = re.GetBoolean(0); } // the error is on this line (this line will alow me to get IsAdmin Value If the user exist)
        con.Close();
        return auth;

    }

Maybe someone has hacked your site using SQL Injection and deleted all the users? Also, SqlDataReader is IDisposable. — ta.speot.is
– ta.speot.is, Commented Apr 2, 2012 at 21:15
This is not an answer to your question, but the way you are making your SQL query is liable to SQL injection attacks. You should always use parameterized queries. — Mike Goodwin
– Mike Goodwin, Commented Apr 2, 2012 at 21:16
Oh this makes me crave to enter a password like '; drop table [user]; -- — Robert Koritnik
– Robert Koritnik, Commented Apr 3, 2012 at 10:44

Mike Goodwin · Accepted Answer · 2012-04-02 21:40:09Z

6

You are open to horrible SQL injection. Your site will be pwned by hackers the very same second you put it online if you don't use parametrized queries.

Like this:

public static bool IsAdmin(string iduser, string password)
{
    using (var conn = new SqlConnection(ConnectionString))
    using (var cmd = conn.CreateCommand())
    {
        conn.Open();
        cmd.CommandText = @"
            SELECT IsAdmin 
            FROM [user] 
            WHERE iduser = @iduser AND mdp = @mdp;
        ";
        cmd.Parameters.AddWithValue("@iduser", iduser);
        cmd.Parameters.AddWithValue("@mdp", password);
        using (var reader = cmd.ExecuteReader())
        {
            return reader.Read() && reader.GetBoolean(reader.GetOrdinal("IsAdmin"));
        }
    }
}

edited Apr 2, 2012 at 21:40

Mike Goodwin

8,9202 gold badges37 silver badges51 bronze badges

answered Apr 2, 2012 at 21:16

Darin Dimitrov

1.0m277 gold badges3.3k silver badges3k bronze badges

Sign up to request clarification or add additional context in comments.

Comments

Mike Goodwin · Accepted Answer · 2012-04-02 21:19:40Z

0

You need to call

re.Read();

to move the reader to the first record before attempting to access the data. re.HasRows does not cause the reader to move to the first record.

Also, definitely use parameterized queries.

answered Apr 2, 2012 at 21:19

Mike Goodwin

8,9202 gold badges37 silver badges51 bronze badges

Collectives™ on Stack Overflow

How to get data in ASP.net MVC

2 Answers 2

Comments

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

2 Answers 2

Comments

Comments

Your Answer

Sign up or log in

Post as a guest

Related