Please explain code

ASPnoob

Hi, I was searching the web for ways to check if a user name is already in existence and I found the following code.

Function DBAuthenticate(ByVal strUsername As String, ByVal strPassword As String) As Integer
Dim bResult As Boolean = False
Dim objConn As New OleDbConnection
Dim strSQL As String
Dim strGoodPassword As String
Dim objCommand As New OleDbCommand

    objCommand.Connection = objConn
    strSQL = String.Format("SELECT p\_w FROM myDB WHERE (email='{0}');", strUsername)
    objCommand.CommandText = strSQL
    objCommand.CommandType = CommandType.Text

    objConn.Open()
    strGoodPassword = CType(objCommand.ExecuteScalar, String)
    objConn.Close()

    If Not strGoodPassword Is Nothing Then
        If strGoodPassword = strPassword Then
            bResult = True
        Else
            lblMessage.Text = "Invalid Login!"
            lblMessage.Text &= "  If you are not a member please click the above link to register."
        End If
    Else
        lblMessage.Text = "Invalid Login!"
        lblMessage.Text &= "  If you are not a member please click the above link to register."
    End If

    Return bResult
End Function

I don't understand three lines of the code above. what does the following mean? Dim objConn As New OleDbConnection(ConfigurationSettings.AppSettings("myDB")) Also what do the lines below do? strSQL = String.Format("SELECT p_w FROM myDB WHERE (email='{0}');", strUsername) strGoodPassword = CType(objCommand.ExecuteScalar, String) Thank you in advance for your help.

J 0

ASPnoob wrote:

Dim objConn As New OleDbConnection(ConfigurationSettings.AppSettings("myDB"))

This line of code instantiates an OleDbConnection. This is a connection to a database such as MS Access. It can be used to query for data, etc.

ASPnoob wrote:

strSQL = String.Format("SELECT p_w FROM myDB WHERE (email='{0}');", strUsername)

This ling of code basically creates a string, and assigns the value to strSQL. For example, if strUserName contains the value "you@urdomain.com", the string that will be contained in strSQL will be "SELECT p_w FROM myDB WHERE (email='you@urdomain.com');"

ASPnoob wrote:

strGoodPassword = CType(objCommand.ExecuteScalar, String)

OK, this one is a little more complicated. objCommand is an OleDbCommand, which can be used to query, update, delete, insert data to or from a database (using the OleDbConnection assigned to it). In this case, they are selecting a single field (p_w) from the table myDB for a particular email address. When you use the .ExecuteScalar() method, you basically are indicating that you are only expecting a single value back from whatever query you are executing. So basically the CType will return a String representation of the p_w you are looking up in the table myDB. If none is found, strGoodPassword will be equal to nothing, otherwise, it will be equal to the p_w value stored in the table myDB for the corresponding email address. I know I probably could've worded that a little better, but hopefully you get the general idea of what is going on now. HTH.

Tirthadip

ASPnoob wrote:

I don't understand three lines of the code above. what does the following mean? Dim objConn As New OleDbConnection(ConfigurationSettings.AppSettings("myDB"))

There is a Configuration file(web.config in case of web application and App.config in case of Windows application) where we can set the connection string as well as other configuration settings of our .NET solution.This is an XML file.Under the appSettings node the connection string is written with the string variable name myDB.whereever in the project you need to reference the connection string you will get it by ConfigurationSettings.AppSettings("myDB")

Tirtha Do not go where the path may lead, go instead where there is no path and leave a trail. Author: Ralph Waldo Emerson (1803-82), American writer, philosopher, poet, essayist