Changing a user Password in vb.net - mysql

Question

So i am trying to change the password of a user in my vb.net project that i been working on. but everytime i run my code i get me catch "Something went wrong". i can't figur out why. i am using a MYSQL database. can anybody help me?
Try
reader = cmd.ExecuteReader()
Dim found As Boolean = False
Do While reader.Read()
If username = DirectCast(reader("username"), String) Then
If password = DirectCast(reader("password"), String) Then
found = True
Else
MessageBox.Show("username and password do not match")
End If
End If
If found = True Then
Dim cmd2 As New MySqlCommand
Dim insertStatment As String = "UPDATE login set password = '" +
newpassword + "' where username = '" + username + "'" , con)
cmd2.ExecuteNonQuery()
MessageBox.Show("password change successfully")
'End If
End If
Loop
Catch
MessageBox.Show("Something went wrong")

Answer 1

You should avoid to use string concatenation to build sql statements. Doing in this way leads the path to errors like when you have a username/password with single quote characters or worst if you have a smart and malicious user that writes something like this in your input textboxes
So you should write
Dim insertStatment As String = "UPDATE login set password = #p1 where username = #p2"
Dim cmd2 As New MySqlCommand(insertStatment, con)
cmd2.Parameters.AddWithValue("#p1", password)
cmd2.Parameters.AddWithValue("#p2", username)
cmd2.ExecuteNonQuery()
Another possible cause of your error is the handling of the MySqlConnection. In your code there is no Open of the connection, so I assume that it is open, but this leads to another problem of your code:
Do not catch exception and then print unusable error message.
If you really want to give a message try to print the error message given in the exception
Catch e As Exception
MessageBox.Show("Something went wrong: " & Environment.NewLine & e.Message)
This will give a pretty clear message that explains what the problem is.