Getting data from a data table in C#

[Brandon Grow]

I currently have a program that will allow for the user to login with a username and password. I am using a data table that has username, password and name as columns. I am trying to get the name to be display on the main form once I have successfully logged in. How would I get the username from the Name column? The code I have that allows for the user to login is:

  private void loginButton_Click(object sender, EventArgs e)
        {
            SqlConnection connection = new SqlConnection(@"Data Source = (LocalDB)\MSSQLLocalDB; AttachDbFilename = C:\Users\brand\Documents\Data.mdf; Integrated Security = True;");
            SqlDataAdapter adapter = new SqlDataAdapter("Select Count(*) From Login where Username='" + usernameTextfield.Text + "' and Password = '" + passwordTextfield.Text + "'", connection);
            DataTable dt = new DataTable();
            adapter.Fill(dt);
            if (dt.Rows[0][0].ToString() == "1")
            {
                this.Hide();
                MainGUIPanel mainview = new MainGUIPanel();
                mainview.Show();
                
            }
            else
            {
                MessageBox.Show("Username or Password Incorrect! Try Again!");
            }

[Claude Moore]

You are executing a SELECT COUNT(*) on a Login table (which, I suppose, holds users' credentials), to verify if the provided userid and password are corrected. That's ok (honestly, i'd use

 dt.Rows.Count 

to verify if credentials are valid; dt.Rows[0][0].ToString() == "1" looks pretty ugly). To retrieve other info (e.g, the Name column values) you have to change your SQL statement (for example, a SELECT * FROM Login).
If row count == 1 you can write:

string str = dt.Rows[0]["Name"];

Hope this helps.

[EricJ Davis]

I noticed something with your query here:

SqlDataAdapter adapter = new SqlDataAdapter("Select Count(*) From Login where Username='" + usernameTextfield.Text + "' and Password = '" + passwordTextfield.Text + "'", connection);

Just so you know, concatenating strings in an SQL query leaves you open to SQL injection vulnerabilities.  It's a good idea to use parameterized queries and other methods to avoid this, particularly when dealing with public facing systems.  Here's more info on SQL injection prevention.  I've written out the equivalent of your query using parameters for your reference.  

Hope this helps.  Happy coding!

string sqlStatement = "SELECT COUNT(*) FROM LOGIN WHERE Username = @username AND Password = @password";
DataTable dt = new DataTable();

SqlDataAdapter adapter = new SqlDataAdapter(sqlStatement, connection);

adapter.SelectCommand.Parameters.Add( new SqlParameter { ParameterName = "@username", Value = usernameTextfield.Text", SqlDbType = SqlDbType.VarChar } );
adapter.SelectCommand.Parameters.Add( new SqlParameter { ParameterName = "@password", Value = passwordTextfield.Text", SqlDbType = SqlDbType.VarChar } );

try
{
adapter.fill(dt);
}

catch(Exception ex)
{
   //code for error handling here
}

[Paul Clapham]

Welcome to the Ranch, Eric, and thanks for the informative post!

[EricJ Davis]

Happy to be here!