Security in winforms c#

Samuel Toh

private void btnCustomFind_Click(object sender, EventArgs e)
{
con.Open();
SqlCommand cmd = con.CreateCommand();
cmd.CommandType = CommandType.Text;

cmd.CommandText = "select Contact from Login where Username='" + txtName.Text + "' ";

txtNumber.Text = Convert.ToString(cmd.ExecuteScalar());

con.Close();

return;

}

So above is my code when the user enters their username, their contact will show.

However, due to security reasons, if the user knows 1 or more different usernames, the user can easily gather their personal particulars. I have a database called "Login" where i keep every User's login.

1) How do I limit the Find to only one user? The one user being the one who logged in.

4 Replies

Know the answer? Post it — somebody with the same question will find it here.

Srinivasan Ramamoorthi4y ago
You have to get users window login if and store that in database against user details. When the user logins get the user login id from system.network and get user details. Don’t allow user to enter the user name
Sachin Singh4y ago
Not in a separate form , if you don't follow n-tier then just create a simple class in your project.
Means right click on project name and add a class, that's it.
Samuel Toh4y ago
for the public class Common, should I create in a seperate form?

My Login form and my User_Update form are both different forms. When I create the public Common, it could not recognise from the other form.
Sachin Singh4y ago
step 1. Create a static property
public static class Common
{
public static userName="";

}
step 2. when users login then set the userName property.
private void btnLogin_Click(.......)
{
// other code
// at last if user is a valid user then
Common.userName=txtUserName.Text;

}
step 3. Don't ask user to enter anything just create a button (yourContact)
private void btnCustomFind_Click(object sender, EventArgs e)
        {
            con.Open();
            SqlCommand cmd = con.CreateCommand();
            cmd.CommandType = CommandType.Text;

            cmd.CommandText = "select Contact from Login where Username='" + Common.userName + "' ";

            txtNumber.Text = Convert.ToString(cmd.ExecuteScalar());

           con.Close();

           return;

       }