Invalid Operation Exception was unhandled - can't update 2 things at once - mysql

Question

This form I made allows the user to change their username, password and/or security passphrase, and it connects and updates on XAMPP database. I have tried looking online, but I am very new to VB and nothing really makes sense.
The problem is I can change any one of them, but if I try change the other after I changed one I get the error:
InvalidOperationException was unhandled
Connection must be valid and open
The error comes here: reader = objcommand.ExecuteReader
This is my code:
`Imports MySql.Data
Imports MySql.Data.MySqlClient
Public Class frmAccountSettings
Private Sub frmAccountSettings_Load(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles MyBase.Load
objconnection.Open()
objdataadapter.SelectCommand = New MySqlCommand
objdataadapter.SelectCommand.Connection = objconnection
objdataadapter.SelectCommand.CommandText = "Select * FROM Login"
End Sub
Private Sub btnBack_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnBack.Click
frmMainMenu.Show()
Me.Hide()
End Sub
Private Sub btnChangeUsername_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnChangeUsername.Click
Dim password1, newusername As String
password1 = InputBox("What is the current password?")
sqlstring = "SELECT password FROM Login WHERE Password = '" &
password1 & "'"
objcommand = New MySqlCommand(sqlstring, objconnection)
reader = objcommand.ExecuteReader
If reader.Read Then
reader.Close()
newusername = InputBox("Enter a new username")
sqlstring = "UPDATE `Login` SET `username` = '" & newusername &
"' WHERE `Login`.`password` = '" & password1 & "'"
objdataadapter.SelectCommand.CommandText = sqlstring
objdataadapter.SelectCommand.CommandType = CommandType.Text
objdataset = New DataSet
objdataadapter.Fill(objdataset, "Login")
objconnection.Close()
Else
MsgBox("Incorrect Username. Please make sure your credentials are correct and try again.", MsgBoxStyle.Critical, "Authentication Failed")
reader.Close()
End If
End Sub
Private Sub btnChangePassword_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnChangePassword.Click
Dim oldpassword, newpassword1 As String
oldpassword = InputBox("What is the current password?")
sqlstring = "SELECT password FROM Login WHERE Password = '" &
oldpassword & "'"
objcommand = New MySqlCommand(sqlstring, objconnection)
reader = objcommand.ExecuteReader
If reader.Read Then
reader.Close()
newpassword1 = InputBox("Enter a new password")
sqlstring = "UPDATE `Login` SET `password` = '" & newpassword1 &
"' WHERE `Login`.`password` = '" & oldpassword & "'"
objdataadapter.SelectCommand.CommandText = sqlstring
objdataadapter.SelectCommand.CommandType = CommandType.Text
objdataset = New DataSet
objdataadapter.Fill(objdataset, "Login")
objconnection.Close()
Else
MsgBox("Incorrect Password. Please make sure your credentials are correct and try again.", MsgBoxStyle.Critical, "Authentication Failed")
reader.Close()
End If
End Sub
Private Sub btnChangeSecurity_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnChangeSecurity.Click
Dim password2, newsecurity As String
password2 = InputBox("What is the current password?")
sqlstring = "SELECT password FROM Login WHERE Password = '" &
password2 & "'"
objcommand = New MySqlCommand(sqlstring, objconnection)
reader = objcommand.ExecuteReader
If reader.Read Then
reader.Close()
newsecurity = InputBox("Enter a new security passphrase")
sqlstring = "UPDATE `Login` SET `security` = '" & newsecurity &
"' WHERE `Login`.`password` = '" & password2 & "'"
objdataadapter.SelectCommand.CommandText = sqlstring
objdataadapter.SelectCommand.CommandType = CommandType.Text
objdataset = New DataSet
objdataadapter.Fill(objdataset, "Login")
objconnection.Close()
Else
MsgBox("Incorrect Password. Please make sure your credentials are correct and try again.", MsgBoxStyle.Critical, "Authentication Failed")
reader.Close()
End If
End Sub
End Class
`

Answer 1

I think that there are a couple of errors in your code. The most serious one is a logic flaw.
You can't be sure that two users choose always different passwords. You need to make sure that your datatable Login has a primary key on the username field and use that field in your queries to uniquely identify the records to be changed. Also, changing a username used as primary key is not an easy task. You need to check if the new user name is not already taken by another user. And if your application is used in a shared environment you need to account also for concurrent changes (two user that decide to change their username to the same new name)
Also, the SelectCommand of the adapter is not the appropriate method to execute database updates. But, there is no need at all to involve the adapter for these operations, you could do everything with a MySqlCommand.
There is another security problem with storing passwords in clear text in a datatable. You should never do that, instead you should apply a hashing function to your password before storing it in the table.
However, limiting my answer to the current problem and excluding the concurrency issue, I would change your code in this way (of course username should be the primary key) ....
Dim password1, newusername, oldusername As String
oldusername = InputBox("Type the current username")
password1 = InputBox("What is the current password?")
newusername = InputBox("Enter a new username")
' identify the current user ... '
sqlstring = "SELECT COUNT(*) FROM `Login` WHERE `username` = #uname AND `password` = #pwd"
objcommand = New MySqlCommand(sqlstring, objconnection)
objcommand.Parameters.AddWithValue("#uname", oldusername)
objcommand.Parameters.AddWithValue("#pwd", password1)
Dim result = objcommand.ExecuteScalar
if result IsNot Nothing AndAlso Convert.ToInt32(result) > 0 Then
' we have good credentials, but the new user name should be unique '
sqlstring = "SELECT COUNT(*) FROM `Login` WHERE `username` = #uname"
objcommand = New MySqlCommand(sqlstring, objconnection)
objcommand.Parameters.AddWithValue("#uname", newusername)
Dim result = objcommand.ExecuteScalar
if result Is Nothing OrElse Convert.ToInt32(result) = 0 Then
' we could change the username of the current user '
sqlstring = "UPDATE `Login` SET `username` = #newame WHERE `username` = #oldname"
objcommand = New MySqlCommand(sqlstring, objconnection)
objcommand.Parameters.AddWithValue("#newame", newusername)
objcommand.Parameters.AddWithValue("#oldname", oldusername)
objcommand.ExecuteNonQuery()
else
MessageBox.Show("Username already taken, choose a different one")
End If
Else
MessageBox.Show("Invalid credentials given")
End If
In this way you use the combination of user and password to uniquely identify your user in the database and change the exact record involved.
In the same way you ask for the username and password when you want to change the password field and update the field only if the username and password match.
EDIT According to your comment above, if there is only one user in the database then you could execute directly the change without any complex checking. (But this is really a case that could not be assumed to be generally common)
sqlstring = "UPDATE `Login` SET `username` = #newame WHERE `password` = #pwd"
objcommand = New MySqlCommand(sqlstring, objconnection)
objcommand.Parameters.AddWithValue("#newame", newusername)
objcommand.Parameters.AddWithValue("#pwd", password1)
objcommand.ExecuteNonQuery()
Another problem is the connection object. It is a global object opened at the Form_Load event and then is kept hanging around your code but in some places you close it and when you try to execute another database operation you forget to reopen in. It is a good practice to NOT have a global object for the connection, instead build one when required, use it and then destroy it
For example
Private Sub btnChangeSecurity_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnChangeSecurity.Click
Using objconnection = new MySqlConnection(....connectionstring goes here ....)
objconnection.Open()
Dim sqlstring = "UPDATE `Login` SET `username` = #newame WHERE `password` = #pwd"
objcommand = New MySqlCommand(sqlstring, objconnection)
objcommand.Parameters.AddWithValue("#newame", newusername)
objcommand.Parameters.AddWithValue("#pwd", password1)
objcommand.ExecuteNonQuery()
End Using
End Sub
If you put your database access code inside a using statement like above, you create the connection object, open it, use it and when done, the End Using statement will close and destroy the connection.