Is there any way to fix this error in VBNET? - mysql

Question

I'm working on a discord bot.
I'm currently working on the login panel (the classic MySQL login way, with the SELECT statement.).
But I've started doing a thing called 2FA, and the way that it works, is the following: If the login was successful the application should set the readytotwofactor column (in MySQL) to true. If it's true, the discord bot generates a 10 letter code, which is appearing in the twofactorcode column. The BOT knows who to send the message to by watching the username entered in the TextBox when logging in. It looks for this in MySQL, and each column (registered username) is associated with a discord ID. Based on this, the BOT knows to whom to send the code that is checked in the MySQL column, the application can identify whether the code is correct or not. Once the code has been sent, the readytotwofactor column will automatically change to false, and the code I wrote should change the value in the twofactorcode column to 0.
My problem, though, is that it doesn't work.
Here is the source code: (Form3 is the login form, and Form4 is the 2FA form.).
Imports MySql.Data.MySqlClient
Public Class Form3
Private Sub Form3_Load(sender As Object, e As EventArgs) Handles MyBase.Load
End Sub
Private Sub btnLogin_Click(sender As Object, e As EventArgs) Handles btnLogin.Click
Dim connection As New MySqlConnection("just the login stuff")
Dim command As New MySqlCommand("SELECT * FROM karolyguilogin WHERE username=#username AND pass=#password", connection)
command.Parameters.Add("#username", MySqlDbType.VarChar).Value = TextBox1.Text
command.Parameters.Add("#password", MySqlDbType.VarChar).Value = TextBox2.Text
Dim command1 As New MySqlCommand("UPDATE `karolyguilogin` readytotwofactor SET readytotwofactor=#readytotwofactor WHERE username=#username", connection)
Dim Adapter As New MySqlDataAdapter(command)
Dim table As New DataTable()
Adapter.Fill(table)
connection.Open()
If TextBox1.Text = "" Then
MessageBox.Show("írj be valamit!")
Me.Close()
End If
If TextBox2.Text = "" Then
MessageBox.Show("írj be valamit!")
Me.Close()
End If
If table.Rows.Count() <= 0 Then
MessageBox.Show("Helytelen felhasználónév, vagy jelszó!")
Else
command1.Parameters.Add("#readytotwofactor", MySqlDbType.VarChar).Value = "true"
MessageBox.Show("Hamarosan megkapod a 2FA kódod!")
Me.Hide()
Form4.Show()
Me.Close()
End If
connection.Close()
End Sub
End Class
Imports MySql.Data.MySqlClient
Public Class Form4
Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click
Dim connection As New MySqlConnection("just the login stuff")
Dim command As New MySqlCommand("SELECT twofactorcode FROM karolyguilogin WHERE twofactorcode = #twofactorcode <> NULL", connection)
command.Parameters.Add("#twofactorcode", MySqlDbType.VarChar).Value = TextBox1.Text
connection.Open()
If TextBox1.Text = "" Then
MessageBox.Show("írj be valamit!")
Me.Close()
End If
Dim Adapter As New MySqlDataAdapter(command)
Dim table As New DataTable()
Adapter.Fill(table)
If table.Rows.Count() <= 0 Then
MessageBox.Show("A kódod helytelen, próbálkozz újra!")
Else
Dim command1 As New MySqlCommand("UPDATE `karolyguilogin` twofactorcode SET twofactorcode=#twofactorcode WHERE twofactorcode <> NULL", connection)
MessageBox.Show("A kódod helyes! Beléphetsz a felületre!")
command1.Parameters.Add("#twofactorcode", MySqlDbType.VarChar).Value = "NULL"
Me.Hide()
Form3.Hide()
Form1.Show()
Me.Close()
Form3.Close()
End If
connection.Close()
End Sub
End Class

Answer 1

In the first place, passwords should never be stored as plain text. I am hoping you have omitted the encryption code for brevity.
In ADO.net connections and commands need to be disposed, not just closed. A Using block will handle this for you even if there is an error.
Don't pull down the entire record. You only need to know if it exists. You don't need a DataAdapter to do this.
Do your validation outside the Using block before any database objects are created. Also, how to you expect the user to "Enter something" when you close the Form?
Use the same command for the second query, just change the CommandText. Note that we already have the #username parameter and the #readytotwofactor parameter is not needed because it can be hardcoded in the sql string.
Why hide the Form and then close it 2 lines later?
Perhaps your code doesn't work because you never execute the second command.
Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click
'Validate first before the database code
If TextBox1.Text = "" OrElse TextBox2.Text = "" Then
MessageBox.Show("írj be valamit!")
Exit Sub
End If
Dim ReturnCount As Integer
Using connection As New MySqlConnection("datasource=sql11.freemysqlhosting.net;port=3306;username=sql11396664;password=eG1IbxNzLR;database=sql11396664"),
command As New MySqlCommand("SELECT Count(*) FROM karolyguilogin WHERE username=#username AND pass=#password", connection)
command.Parameters.Add("#username", MySqlDbType.VarChar).Value = TextBox1.Text
command.Parameters.Add("#password", MySqlDbType.VarChar).Value = TextBox2.Text
connection.Open()
ReturnCount = CInt(command.ExecuteScalar())
If ReturnCount = 0 Then
MessageBox.Show("Helytelen felhasználónév, vagy jelszó!")
Else
command.CommandText = "UPDATE `karolyguilogin` readytotwofactor SET readytotwofactor='true' WHERE username=#username"
command.ExecuteNonQuery()
MessageBox.Show("Hamarosan megkapod a 2FA kódod!")
Form4.Show()
Me.Close()
End If
End Using 'Closes and disposes both the command and the connection
End Sub
I assume there is some sort of trigger in the database when readytotwofactor is set to true.
You realize your Update will set all records in the karolyguilogin table to the string "NULL" not just the the user attempting to log in. If this is a multiuser database this could cause a problem.
Private Sub Button2_Click(sender As Object, e As EventArgs) Handles Button2.Click
If TextBox1.Text = "" Then
MessageBox.Show("írj be valamit!")
Exit Sub
End If
Dim ReturnCount As Integer
Using connection As New MySqlConnection("datasource=sql11.freemysqlhosting.net;port=3306;username=sql11396664;password=eG1IbxNzLR;database=sql11396664"),
command As New MySqlCommand("SELECT Count(*) FROM karolyguilogin WHERE twofactorcode = #twofactorcode", connection)
command.Parameters.Add("#twofactorcode", MySqlDbType.VarChar).Value = TextBox1.Text
connection.Open()
ReturnCount = CInt(command.ExecuteScalar())
If ReturnCount = 0 Then
MessageBox.Show("A kódod helytelen, próbálkozz újra!")
Else
command.CommandText = "UPDATE `karolyguilogin` SET twofactorcode='NULL' WHERE twofactorcode <> 'NULL';"
MessageBox.Show("A kódod helyes! Beléphetsz a felületre!")
Form1.Show()
Me.Close()
End If
End Using 'Closes and disposes both the command and the connection
End Sub
I had fun translating the Hungarian message boxes so I could better understand your code.