"The multi part identifier could not be bound" sql, visual studio

I am just learning c# and sql server. This question has been asked a couple of times but the solutions posted don't seem to help me. I have a table called "LoginInfo" that has a user's "email" and "pass". In visual studio i have this method that checks a users login information

private boolean dbQueryLogin(string email, string password)
    {
       string com = "SELECT pass FROM LoginInfo WHERE email = XXXXX@yahoo.com";

        SqlCommand command = new SqlCommand(com, conn);
        SqlDataReader reader = command.ExecuteReader();

       return reader.GetString(0).Equals(password);
    }

This keeps on throwing the error "Additional information: The multi-part identifier "XXXX.edu" could not be bound." The syntax looks right to me, is there anything i'm missing??

Jon Skeet
people
quotationmark

The clue is in the error message:

The multi-part identifier "XXXX.edu" could not be bound.

That strongly suggests that the problem isn't with identifying your table - it's with the bit that ends with "edu", which seems like to be an email address.

The immediate problem is that you've forgotten to quote a value. The deeper problem is that you should be using parameterized SQL anyway, to avoid SQL injection attacks, conversion problems and unreadable code. Given that the value you've given in the same code isn't the same as what's in the error message, I suspect you really have code like:

string sql = "SELECT pass FROM LoginInfo WHERE email = " + email;

Don't do that. Use parameterized SQL instead:

private boolean dbQueryLogin(string email, string password)
{
    string sql = "SELECT pass FROM LoginInfo WHERE email = @email";
    using (var connection = new SqlConnection(connectionString))
    {
        using (var command = new SqlCommand(sql))
        {
            command.Parameters.Add("@email", SqlDbType.NVarChar).Value = email;
            using (var reader = command.ExecuteReader())
            {
                // FIXME: What do you want to do if
                // there are no matches?
                reader.Read();
                return reader.GetString(0) == password;
            }
        }
    }
}

This still isn't good code though:

  • Don't store plain-text passwords in a database
  • Handle the case where there are no results
  • Don't build your own authentication system at all; use an existing one written by people with more experience in securing data

people

See more on this question at Stackoverflow