Android Question SQLite Admin User Login

Erel

B4X founder

Staff member

Licensed User

Longtime User

• Oct 30, 2016

• #2

Are you storing the users in a local database? Add another column with the user's type.

 

Upvote 0

V

vinzpogi

Member

• Oct 30, 2016

• #3

Yes my database is stored locally. I actually do have a column with usertype in it. My column is like this:

ID | username | password | usertype
1 admin admin Admin
2 user user User

My problem is that i can't find a code where when i click the submit button, it can define if it is an Admin or a User. If it's an Admin, it will move to the Admin Layout. Same with the User. Here's a sample of the code i saw online

 

Attachments

• a.PNG

  22.1 KB · Views: 598

Upvote 0

M

Mahares

Expert

Licensed User

Longtime User

• Oct 30, 2016

• #4

B4X:

if Cursor1.rowcount<> 0 then
     msgbox("success","success")
     cursor1.position =0
     Dim MyUser as string =cursor1.getstring("usertype")
      if MyUser ="Admin" then
         Activity.loadlayout("AdminLayout")
      else
         Activity.loadlayout "UserLayout")
      .
      .
      'continue with the rest of your code

 

Upvote 0

V

vinzpogi

Member

• Oct 30, 2016

• #5

THAAAAAAAAAANK YOUUUUUUUU Mahares ! It's working now

 

Upvote 0

mc73

Well-Known Member

Licensed User

Longtime User

• Nov 1, 2016

• #6

No mean to hijack the thread, but by watching your query, I have to warn you to be more careful and try to handle possible sql injections.
In the query you post, if you place, for example:

username text: ' or not('1'<>'1

password text: ') or '1'='1

, your query will then be:

select * from adminclient where username='' or not('1'<>'1' and password='') or '1'='1'

This will always return the complete list of users, thus getting someone to login without knowing any user name or password.

B4A has the query2 method, which is more safe.

 

Upvote 0

V

vinzpogi

Member

• Nov 1, 2016

• #7

Hello Sir. I tried what you posted and IT DID logged in ! Can you help me revise my code there. I'm just new here sorry and thanks for the tip !

 

Upvote 0

fixit30

Active Member

Licensed User

Longtime User

• Nov 1, 2016

• #8

You should use ExecQuery2

B4X:

cursor1 = sql1.ExecQuery2("SELECT * FROM adminclient WHERE username = ? AND password = ?", Array as  String(username.Text, password.Text))

 

Upvote 0

V

vinzpogi

Member

• Nov 1, 2016

• #9

Thank you for the quick response fixit30 ! Its all good now. When i try it again it doesn't logged in anymore.

 

Upvote 0