I am getting an error that reads:

Line 1:Incorrect syntax near 'Username'


This error happens at a point in my code when i am verifying a users creadentials.

Dim saved As String = hdcmd.ExecuteScalar()

Please advice

your sql command text may contain some error. Please post your sql query.

urt

Help yourself by helping someone.

Hello urt

hdstr = "SELECT Password FROM LogFile WHERE Username=' & UsernameTextBox.Text & "'"
hdcmd = New SqlCommand(hdstr, hdcon)
hdcmd.Parameters.Add(New SqlParameter("Username", UsernameTextBox.Text))

the last line is what i beleive is throwing the error.

Thanks
asters

You are mixing apples and oranges. Either build the full query or use parameters (I'd recommend the latter). In this case you are not providing the sql command a username variable to fill in. Try something like this:

hdstr = "SELECT Password FROM LogFile WHERE Username=@UserName"
hdcmd = New SqlCommand(hdstr, hdcon)
hdcmd.Parameters.Add(New SqlParameter("@Username", UsernameTextBox.Text))

Doing this will also help reduce your suseptibility to SQL injection attacks. Someone could put in a value into your username textbox that looks like this:

   '; <some some really bad database stuff here>; select '

That would execute the second part of the query because they put in the quote delimiters that close the username value.

-Peter

Thank you this worked.