Question Query sdf database from vb

[fooforever]

Hi I'm looking for help with a small app I'm writing, im a total beginner so it could be very badly coded. Its a simple user verification app it does not need any great security it just needs to do the job. Its going to be used as a front end to open a database file. Im having problems with my query, it always returns a false value heres my code:

Imports System.Data.SqlServerCe

Public Class Form1
    Dim conn As SqlCeConnection = Nothing
    Dim SearchResult As Boolean
    Dim strSQL As String = "SELECT * FROM Users WHERE Username = '" & Username & "' AND Password = '" & Password & "'"
    Dim objCmd As New SqlCeCommand(strSQL, conn)
    Dim Username As String
    Dim Password As String

    Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click
        If SearchResult = True Then
            FileOpen(FreeFile, "database path", OpenMode.Append, OpenAccess.Default, OpenShare.Default)
            Close()
        Else
            MsgBox("Login Failed")
        End If
    End Sub

    Private Sub Button2_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button2.Click
        Me.Close()
    End Sub

    Private Sub Button3_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button3.Click
        Form2.Show()
    End Sub

    Public Sub Search()
        conn = New SqlCeConnection("Data Source =.\Database1.sdf")
        conn.Open()
        If strSQL = True Then
            SearchResult = True
        End If
        conn.Close()
    End Sub

    Public Sub TextBox1_TextChanged(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles TextBox1.TextChanged
        Username = TextBox1.Text
    End Sub

    Private Sub TextBox2_TextChanged(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles TextBox2.TextChanged
        Password = TextBox2.Text
    End Sub
End Class

Any help would be greatly appreciated, the problem is that I allways get the Login Failed message box.

 

[jmcilhinney]

SearchResult is False by default. At no point do you set it to True. You've got code in your Search method that sets it to True, but you never actually call that method. Even if you did, it wouldn't help. You never actually execute a query. You open a connection but then all you do is this:

If strSQL = True Then

How can strSQL ever be equal to True? This is the only place you ever set strSql:

Dim strSQL As String = "SELECT * FROM Users WHERE Username = '" & Username & "' AND Password = '" & Password & "'"

That's a String, so how can it ever be True? I suggest that you take a look at this:

Validate Credentials Against User Record in Database