MySQL statement to save password to Database? - mysql

Question

I have an SQL statement that saves a username into a MySQL database on phpmyadmin that works like a charm:
Dim SQLStatement As String = "INSERT INTO accountinfodb(`Usernames`) VALUES ('" & txtUsername.Text & "')"
However
I also ask for the users password, which I'd like to store as well, so I though this would make sense:
Dim SQLStatement As String = "INSERT INTO accountinfodb(`Usernames`, `Passwords`) VALUES ('" & txtUsername.Text & txtPasswd.Text & "')"
Unfortunately this code does not work, I get errors about a valid and open connection, or a syntax error in my MySQL syntax. So I was wondering if anyone knew the correct way to store the username and password into my DB?
Here is my FULL vb.net code.
Imports MySql.Data.MySqlClient
Public Class frmSignup
Dim ServerString As String = "Server=localhost;User Id=root;Password=;Database=accountinfo"
Dim SQLConnection As MySqlConnection = New MySqlConnection
Private Sub Form3_Load(sender As Object, e As EventArgs) Handles MyBase.Load
SQLConnection.ConnectionString = ServerString
Try
If SQLConnection.State = ConnectionState.Closed Then
SQLConnection.Open()
MsgBox("Successfully connected to DB")
Else
SQLConnection.Close()
MsgBox("Failed to connect to DB")
End If
Catch ex As Exception
MsgBox(ex.ToString)
End Try
End Sub
Public Sub SaveAccountInformation(ByRef SQLStatement As String)
Dim cmd As MySqlCommand = New MySqlCommand
With cmd
.CommandText = SQLStatement
.CommandType = CommandType.Text
.Connection = SQLConnection
.ExecuteNonQuery()
End With
SQLConnection.Close()
SQLConnection.Dispose()
End Sub
Private Sub btnSignup_Click(sender As Object, e As EventArgs) Handles btnSignup.Click
If txtPasswd.Text = txtPasswd2.Text Then
MessageBox.Show("Passwords Match!")
Dim SQLStatement As String = "INSERT INTO accountinfodb(`Usernames`, `Passwords`) VALUES ('" & txtUsername.Text & txtPasswd.Text & "')"
SaveAccountInformation(SQLStatement)
MessageBox.Show("Account Successfully Registered")
Else
MessageBox.Show("Passwords Do Not Match!")
txtPasswd.Text = Focus()
txtPasswd.Clear()
txtPasswd2.Text = Focus()
txtPasswd2.Clear()
End If
End Sub
End Class
EDIT 1
#Rahul
I added your SQL Statement to my code and I am given the following error when I input a random username/passwd
An unhandled exception of type 'MySql.Data.MySqlClient.MySqlException'
occurred in MySql.Data.dll
Additional information: You have an error in your SQL syntax; check
the manual that corresponds to your MariaDB server version for the
right syntax to use near 'test')' at line 1

Answer 1

Look at your SQL INSERT statement, it's missing a , comma in VALUES section
VALUES ('" & txtUsername.Text & txtPasswd.Text & "')
^... Here
Your statement should look like
"INSERT INTO accountinfodb(`Usernames`, `Passwords`)
VALUES ('" & txtUsername.Text & "','" & txtPasswd.Text & "')"
Edit:
I must mentioned that your current code is vulnerable to SQL Injection attack due to the fact that you are passing user input directly as concatenated values. You should rather use SqlParameter and pass those values as parameter instead accordingly. A sample would be
Dim SQLStatement As String = "INSERT INTO accountinfodb(`Usernames`, `Passwords`) VALUES (#username, #password)"
cmd.Parameters.AddWithValue("#username", txtUsername.Text.Trim())
cmd.Parameters.AddWithValue("#password", txtPasswd.Text.Trim())