SqlDataReader Read() method fails!

[rekhad]

I am calling validateUser(name,password)method from my login_click button handler method.The
if(validateUser(name,password))statement is always false

I debugged the program and found out that :if(!dread.Read())returns false
why my dread.Read() doesn't work?
please help...

private void login_Click(object sender, System.EventArgs e)
{
string name,email,password;
name=txtname.Text;
email=txtemail.Text;
password=txtpwd.Text;
if(validateUser(name,password))
{.......
}

private bool validateUser(string id, string unHashedpassword)
{
string Connectionstring="Data Source=*******;"uid=*****;"+
"pwd=*****;"+"Initial Catalog=P_Society;";
bool result=false;
string hashedpwd=FormsAuthentication.HashPasswordForStoringInConfigFile(unHashedpassword,"Sha1");
SqlConnection conn=new SqlConnection(Connectionstring);
string sql="SELECT Password FROM DoctorInfo WHERE Name LIKE 'id'";
conn.Open();
SqlCommand cmd=new SqlCommand(sql,conn);
SqlDataReader dread=cmd.ExecuteReader();
if(!(dread.Read()))
result=false;

else
{
if(dread.IsDBNull(0))
result=false;
else
{
result=String.Equals(hashedpwd,dread.GetString((0)));
}
dread.Close();
conn.Close();
}
return result;
}
}
}

[TheNige]

Have you tried running the debugger and stepping through the code to see what values are being returned?

[Easy_Coder]

Have you traced the database to see if your query is firing at that level?

>>WHERE Name LIKE
Curious as to why you use LIKE to secure credentials instead of something specific
where Name = 'blah' and password = 'blah'

[carguy84]

Your SQL is wrong:

"SELECT Password FROM DoctorInfo WHERE Name LIKE 'id'"
should be:

"SELECT Password FROM DoctorInfo WHERE Name LIKE '" + id + "'"

Chip-