CodeGuru Home VC++ / MFC / C++ .NET / C# Visual Basic VB Forums Developer.com
Results 1 to 2 of 2

Thread: SQL Issue

  1. #1
    Join Date
    May 2004
    Posts
    1

    Angry SQL Issue

    Code:
    Public Sub Command1_Click()
    Private rs As adodb.Recordset
    Dim isBanned As Boolean
    Dim sql As String
    Dim inputIP As String
    
    Open_dbcon
    
     Set rs = dbcon.Execute("Select id,alias,pass from `users` Where alias= '" & Text1.Text & "' AND pass= '" & Text2.Text & "'")
       
            If rs.EOF Or rs.BOF Then
                MsgBox "Incorrect Username or Password.", vbCritical + vbOKOnly, "Login Failed"
                Text2.Enabled = True
                Text2.Text = ""
                Text2.SetFocus
            Else
            Form1.Show
            Unload Form4
                sAccountID = rs("id")
                End If
                
    inputIP = Winsock1.LocalIP
    If inputIP = "127.0.0.1" Then
    MsgBox "You must be connected to the internet", vbExclamation, ""
    End
    Else
    End If
    rs.Close
    
    sql = "SELECT * FROM `ipaddress` WHERE IP = '" & inputIP & "'"
    rs.Open sql, cn 'where cn is the connection to the db, rs is the recordset
    
    While Not rs.EOF And Not isBanned
        If CStr(inputIP) = CStr(rs("IP")) Then
             isBanned = True
        End If
        rs.MoveNext
    Wend
    
    If Not isBanned Then
    Form1.Show
    Else
       MsgBox "You are banned"
    End If
    dbcon.Close
    End Sub
    Run-time error '3001':

    Arguments are of the wrong type, are out of acceptable range, or are in conflict with one another.


    Can someone put the "rs.Close" and "dbcon.Close" and whatever where they should be, and post it please.

    Please

  2. #2
    Join Date
    Apr 2002
    Location
    Egypt
    Posts
    2,210
    you did not tell us where does the error appear
    i think it's in dbcon.Execute

    • you don't need quotations around the table name ( users not 'users')
    • Don't use this way of concatinating strings..It can cause a security whole in your application called SQL Injection..
      use commands with parameters instead.
    Hesham A. Amin
    My blog , Articles


    <a rel=https://twitter.com/HeshamAmin" border="0" /> @HeshamAmin

Posting Permissions

  • You may not post new threads
  • You may not post replies
  • You may not post attachments
  • You may not edit your posts
  •  





Click Here to Expand Forum to Full Width

Featured