Verification in login form

Question

I am not able to do a check in the database, to make sure that the user exists. Follow the code:

private void button1_Click_1(object sender, EventArgs e)
{
    string conexao = "SERVER = localhost; DATABASE = dizimistas; UID = root; PASSWORD = senha00789;";
    string query = "SELECT idusuario FROM USUARIOS WHERE nomeusuario = @usuario and senhausuario = @senha;";

    using (MySqlConnection objConexao = new MySqlConnection(conexao))
    {
        objConexao.Open();
        try
        {
            MySqlCommand command = new MySqlCommand(query, objConexao);
            command.Parameters.AddWithValue("@usuario", txtUsuario);
            command.Parameters.AddWithValue("@senha", txtSenha);

            int? id = (int?)command.ExecuteScalar();
            if (id.HasValue)
            {
                FormPrincipal form = new FormPrincipal();
                form.Show();
            } else
            {
                MessageBox.Show("Usuário ou senha inválidos!");
            }
        }
        finally
        {
            objConexao.Close();
        }
    }
}

If the query returns true (User exists), then it will be taken to another form. However everything I put in this IF, visual studio does not accept.

Answer 1

Dear Pedro, first of all, never use string concatenation to assemble your SQL clauses. So you avoid the SQL Injection.

I put together an example of how I would look using parameters.

string conexao = "SERVER = localhost; DATABASE = dizimistas; UID = root; PASSWORD = senha00789;";
string query = "SELECT idusuario FROM USUARIOS WHERE usuario = @usuario and senha = @senha;";

using (MySqlConnection objConexao = new MySqlConnection(conexao))
{
    objConexao.Open();
    try
    {
        MySqlCommand command = new MySqlCommand(query, objConexao);
        command.Parameters.AddWithValue("@usuario", txtUsuario);
        command.Parameters.AddWithValue("@senha", txtSenha);

        var dataReader = command.ExecuteReader();
        if (dataReader.Read())
        {

        }
    }
    finally
    {
        objConexao.Close();
    }                
}

The clause using provides convenient syntax that ensures correct use of objects Idisposable. Use the try finally after opening the connection, to ensure that when completing the entire operation within the try the connection is always closed.