Ado.net C# login check Ms Sql using a windows form application -

hi tring develope login screen. in windows form aplication. got:

   private void button1_click(object sender, eventargs e)    {        if ((textbox1.text == "") || (textbox2.text == ""))        {            messagebox.show("bu alanları boş bırakamazsınız.", "chat giriş", messageboxbuttons.ok, messageboxicon.error);            return;        }         sqlconnection conn = new sqlconnection();        conn.connectionstring = "server=cagdas-laptop;database=chat;trusted_connection=true;";        conn.open();          dataset ds = new dataset();        sqldataadapter sda = new sqldataadapter("select * kullanici kul_adi='" + textbox1.text + "' , sifre='" + textbox2.text + "'", conn);        sda.fill(ds);         if (ds.tables.count == 0)        {            messagebox.show("geçersiz kullanıcı.", "chat giriş", messageboxbuttons.ok, messageboxicon.error);         }         else if(ds.tables.count == 1)        {                messagebox.show("hoşgeldiniz.", "chat giriş", messageboxbuttons.ok, messageboxicon.information);        } 

by way using ms sql , logged windows authentication. not sure did write connection string right. when run program doesnt matter write, unless if fill both textbox "hosgeldiniz"(welcome) message. problem? doing wrong? information: kullanici user geçersiz kullanici means wrong login info hosgeldiniz means welcome in language.

whatever user types correct password , account or not, code returns datatable inside dataset; no rows, if login incorrect, 1 row. if login correct. so, testing if there table or not return there @ least 1 table.

you should check if there datarows in table returned

   dataset ds = new dataset();    sqldataadapter sda = new sqldataadapter("select * kullanici ....");    sda.fill(ds);     if (ds.tables[0].rows.count == 0)    {        messagebox.show("geçersiz kullanıcı.", "chat giriş", messageboxbuttons.ok, messageboxicon.error);     }    else if(ds.tables[0].rows.count == 1)    {        messagebox.show("hoşgeldiniz.", "chat giriş", messageboxbuttons.ok, messageboxicon.information);    } 

said that, there better ways check correctness of input , avoid big problem called sql injection

private void button1_click(object sender, eventargs e) {    if ((textbox1.text == "") || (textbox2.text == ""))    {        messagebox.show("bu alanları boş bırakamazsınız.", "chat giriş", messageboxbuttons.ok, messageboxicon.error);        return;    }     string cmdtext = @"select count(*) kullanici                        kul_adi=@user , sifre=@pwd";    using(sqlconnection conn = new sqlconnection("server=cagdas-laptop;database=chat;trusted_connection=true;"))    using(sqlcommand cmd = new sqlcommand(cmdtext, conn))    {        conn.open();        cmd.parameters.addwithvalue("@user", textbox1.text);        cmd.parameters.addwithvalue("@pwd", textbox2.text);        int usercount = convert.toint32(cmd.executescalar());        if (usercount == 0)        {            messagebox.show("geçersiz kullanıcı.", "chat giriş", messageboxbuttons.ok, messageboxicon.error);         }        else if(usercount == 1)        {            messagebox.show("hoşgeldiniz.", "chat giriş", messageboxbuttons.ok, messageboxicon.information);        }    } } 

in way, there no need have dataset, count records match passed login informations.

notice have placed opening of connection , building of command inside using statement block ensure proper closing , disposing of connection , command in case of exceptions.

a final note. bad idea store password in clear text in database. better security consider using hashing algorithm transform password in unreadable , not decryptable. store hashed text instead of password in clear text and, when need check password. reapply same hashing algorithm user input , check resulting text stored text.