Verify login data from username and password columns - sql-server

Question

I wrote the following function to verify log in data for user, but so far its not working as it should and I am sure there is something wrong with it:
Private Sub button2_Click(ByVal sender As System.Object, ByVal e As System.Windows.RoutedEventArgs) Handles button2.Click
If loginpasswordtx.Text.Length > 1 And loginpasswordtx.Text.Length > 1 And My.Settings.SQLConnectionString.Length > 5 Then
Try
Dim cnn As New SqlConnection(My.Settings.SQLConnectionString)
Dim cmd = New SqlCommand("SELECT AppUser,AppUserPass FROM OrderAppUsers WHERE AppUser=#AppUser AND AppUserPass=#AppUserPass", cnn)
cmd.Parameters.Add(New SqlParameter("#AppUser", createuserAppUser.Text))
cmd.Parameters.Add(New SqlParameter("#AppUserPass", MD5StringHash(loginpasswordtx.Text)))
cnn.Open()
Dim obj As Object = cmd.ExecuteScalar()
If obj = Nothing Then
MsgBox("Faild to Log in, check your log in info")
cnn.Close()
Return
End If
cnn.Close()
Catch ex As SqlException
MsgBox(ex.Message)
Return
End Try
MsgBox("Logged in Successfully")
End If
End Sub
All I get is a null obj even though user and pass exist in the table.
the following code is for adding new users
Try
Dim cnnstring As String = String.Format("Server={0};Database={1};Trusted_Connection=True;", createuserServerTx.Text, createuserDatabaseTx.Text)
Dim cnn As New SqlConnection(cnnstring)
Dim cmd As New SqlCommand("INSERT INTO OrderAppUsers VALUES (#AppUser, #AppUserPass)", cnn)
cmd.Parameters.Add(New SqlParameter("#AppUser", createuserAppUser.Text))
cmd.Parameters.Add(New SqlParameter("#AppUserPass", MD5StringHash(createuserpassword.Text)))
cnn.Open()
cmd.ExecuteNonQuery()
cnn.Close()
MsgBox("User Crated Successfully")
LayoutControl1.Visibility = Windows.Visibility.Collapsed
My.Settings.SQLConnectionString = cnnstring
My.Settings.Save()
Catch ex As SqlException
MsgBox(ex.Message)
End Try
and the function to generate a custom hash
Private Function MD5StringHash(ByVal strString As String) As String
Dim MD5 As New MD5CryptoServiceProvider
Dim Data As Byte()
Dim Result As Byte()
Dim R As String = ""
Dim Temp As String = ""
Data = Encoding.ASCII.GetBytes(strString)
Result = MD5.ComputeHash(Data)
For i As Integer = 0 To Result.Length - 1
Temp = Hex(3 * Result(i) + 1)
If Len(Temp) = 1 Then Temp = "0" & Temp
R += Temp
Next
Return R
End Function

Answer 1

Try the following when adding parameter
cmd.Parameters.AddWithValue("#AppUser", createuserAppUser.Text)
cmd.Parameters.AddWithValue("#AppUserPass", MD5StringHash(loginpasswordtx.Text))
or just stick with what you did but a little different than yours,
cmd.Parameters.Add("#AppUser", SqlDbType.VarChar)
cmd.Parameters("#AppUser").Value = createuserAppUser.Text
cmd.Parameters.Add("#AppUserPass", SqlDbType.VarChar)
cmd.Parameters("#AppUserPass").Value = MD5StringHash(loginpasswordtx.Text)
by the way, when using ExecuteScalar() it only returns single value. So your query can be written as
SELECT COUNT(*)
FROM OrderAppUsers
WHERE AppUser=#AppUser AND AppUserPass=#AppUserPass
and you can use int variable to store its value
Dim obj As int = Cint(cmd.ExecuteScalar())
so the possible values are 0 or the total number of records return.
If obj = 0 Then
MsgBox("Faild to Log in, check your log in info")
'' other codes
End If
and by refractoring your code, use Using -Statement
Using cnn As New SqlConnection(My.Settings.SQLConnectionString)
Using cmd = New SqlCommand("SELECT COUNT(*) FROM OrderAppUsers WHERE AppUser=#AppUser AND AppUserPass=#AppUserPass", cnn)
cmd.Parameters.AddWithValue("#AppUser", createuserAppUser.Text)
cmd.Parameters.AddWithValue("#AppUserPass", MD5StringHash(loginpasswordtx.Text))
cmd.CommandType = CommandType.Text
Try
cnn.Open()
Dim obj As int = Cint(cmd.ExecuteScalar())
If obj = 0 Then
MsgBox("Faild to Log in, check your log in info")
Else
MsgBox("Logged in Successfully")
End If
Catch(ex As SqlException)
MsgBox(ex.Message.ToString())
End Try
End Using
End Using

Answer 2

I checked your code in my local system and it is working fine i mean i was able to validate its return true i analysis and found its return false only when i am adding one space on password text before encrypt can u check in database value is space adding into password value or can u post your encrypt code