调用Read（）vb.NET和MySQL之前尝试访问字段无效

Question

I receive this error every time I try log in with incorrect details which should show a message-box "invalid username..." and when no details are entered it should show "please enter...

    conn = New MySqlConnection
    conn.ConnectionString = "server=localhost; userid=root; password=...; database=..."
    Dim reader As MySqlDataReader

    Try
        conn.Open()
        Dim Query As String
        Query = "SELECT Username, Password, Admin FROM appointments.tblLogin WHERE Username='" & TextBox_Username.Text & "' AND Password='" & TextBox_Password.Text & "' "
        cmd = New MySqlCommand(Query, conn)
        reader = cmd.ExecuteReader

        Dim count As Integer
        count = 0
        While reader.Read
            count = count + 1
        End While

        If reader.GetInt32("Admin") = 1 Then
            AdminMainMenu.Show()
            Me.Hide()
        ElseIf reader.GetInt32("Admin") = 0 Then
            MainMenu.Show()
            Me.Hide()
        Else
            MessageBox.Show("Invalid username or password")
        End If

        If TextBox_Username.Text.Equals("") And TextBox_Password.Text.Equals("") Then
            MessageBox.Show("Please enter a username and password")
        End If

        conn.Close()

    Catch ex As MySqlException
        MessageBox.Show(ex.GetBaseException.ToString)
    Finally
        conn.Dispose()
    End Try

Answer 1

The MySqlDataReader can move forward-only, once it reaches the end of the rows retrieved by the command, it cannot go back to read previous rows.
The loop used to count the number of rows moves the reader to the end of the data stream. So trying to read the Admin field result in an exception.

If TextBox_Username.Text.Equals("") And _
   TextBox_Password.Text.Equals("") Then
    MessageBox.Show("Please enter a username and password")
   Return
End If

.... opening and executing the command code....

If reader.Read Then
    Dim isAdmin = (reader.GetInt32("Admin") = 1)
    If isAdmin Then
       AdminMainMenu.Show()
       Me.Hide()
    Else Then
       MainMenu.Show()
       Me.Hide()
    End If
Else 
    MessageBox.Show("Invalid username or password")
End If
conn.Close()

Notice that I have removed the loop and used a simple if/else statement around the Read method to display the error message and I have changed the reading of the Admin flag creating a boolean variable to simplify the logic inside the true part of the if block.

Said that, you need to look at how build parameterized queries because your string concatenation to build the commandtext exposes your program to Sql Injection Attacks (not to mention syntax errors if some of your textbox contains a single quote, try it...)

Consider also that from a security standpoint you should never store passwords in the database in clear text. Use always an hash of the password