Question Login Access Page

[Carol_84]

Hi,
I'm creating my own login page. Here is the code below. I'm able to read from my database but i got difficulty differentiating the admin and user. Can anyone please help me? Thank you very much
Protected Sub Button1_Click(ByVal sender As Object, ByVal e As EventArgs) Handles LoginButton.Click
Dim log_statement As String = "SELECT * FROM UserInfo where UserName='" & username.Text & "' and Password='"& Password.Text & "'"
Dim con2 As SqlCommand
Dim con1 As SqlConnection
Dim reader As SqlDataReader
con1 =New SqlConnection(SqlDataSource1.ConnectionString)
con1.Open()
con2 =New SqlCommand(log_statement, con1)
reader = con2.ExecuteReader()
Ifreader.Read()Then
If reader("AccessRight") = "Admin"Then ' I got difficulty running this code
Response.Redirect("AdminPage.aspx")
Else
Response.Redirect("UserPage.aspx")
EndIf
Else
ErrorMsg.Text ="Invalid username and password!"
EndIf

 

[Menthos]

Have you put a breakpoint at your 'difficult' point and seen what value your reader field has?

 

[Carol_84]

Ya i got try to display the info in a textbox. It shows "Admin". Anyway, i'd already solve my problem.
It's due to SQL injection. I'd rewrite my code and got it correct. Thanks for your help!! =)