Wayback Machinekoobas.hobune.stream
May JUN Jul
Previous capture 13 Next capture
2021 2022 2023
1 capture
13 Jun 22 - 13 Jun 22
sparklines
Close Help
  • Products
  • Solutions
  • Made with Unity
  • Learning
  • Support & Services
  • Community
  • Asset Store
  • Get Unity

UNITY ACCOUNT

You need a Unity Account to shop in the Online and Asset Stores, participate in the Unity Community and manage your license portfolio. Login Create account
  • Blog
  • Forums
  • Answers
  • Evangelists
  • User Groups
  • Beta Program
  • Advisory Panel

Navigation

  • Home
  • Products
  • Solutions
  • Made with Unity
  • Learning
  • Support & Services
  • Community
    • Blog
    • Forums
    • Answers
    • Evangelists
    • User Groups
    • Beta Program
    • Advisory Panel

Unity account

You need a Unity Account to shop in the Online and Asset Stores, participate in the Unity Community and manage your license portfolio. Login Create account

Language

  • Chinese
  • Spanish
  • Japanese
  • Korean
  • Portuguese
  • Ask a question
  • Spaces
    • Default
    • Help Room
    • META
    • Moderators
    • Topics
    • Questions
    • Users
    • Badges
  • Home /
avatar image
0
Question by Nynex · Mar 26, 2013 at 06:58 PM · c#dllmysql

Unity C# MySQL Issues

I got most of the things working but im a bit confused on what to do next.

I need to know how to figure out if the log in info is correct.

I followed what this guy, SixTimesNothing, did (http://forum.unity3d.com/threads/11466-Reading-database-and-or-spreadsheets) and i have no errors but im not sure how to verify if the information is correct. I have this and im trying to figure out what to do

 public bool ValidInformation(string User, string Pass)
     {
         doQuery("SELECT ID FROM rz_users WHERE Username = " + User +" AND Password = " + Pass);
         
         
         return false;
         
     }

i know in php i could run a mysql_num_rows($data) and have $data equal to my doQuery But what is c#'s version of mysql_num_rows

Comment
Add comment · Show 6
10 |3000 characters needed characters left characters exceeded
▼
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Viewable by all users
avatar image QuantumCD · Mar 27, 2013 at 01:53 AM 0
Share

I'm kind of unclear on what you want to do. Do you need the number of rows that the result returns? If so, you should probably read in all the results into a generic or something similar.

Also, it looks like you are trying to see if a username exists or not, so what I would first check off is that your Username field on your rz_users table is unique. Then, you could just see if the query returns 0 results to check if the username exists. That is, a simple if statement checking if the query results are null.

avatar image Nynex · Mar 27, 2013 at 02:05 PM 0
Share

yeaaah do you think you could help me write that query check?

avatar image QuantumCD · Mar 27, 2013 at 02:08 PM 0
Share

Sure. I've done something similar. Just basically run the SqlDataReader or whatever you are using, and check if the query is null. Could you clarify a bit on what doQuery is? Is this a method you've written yourself? I've never seen it.

avatar image Nynex · Mar 27, 2013 at 05:17 PM 0
Share

doQuery was what the guy SixTimesNothing wrote,

 // $$anonymous$$ySQL Query
 
     public static void doQuery(string sqlQuery) {
 
         IDbCommand dbCommand = dbConnection.CreateCommand();
 
         dbCommand.CommandText = sqlQuery;
 
         IDataReader reader = dbCommand.ExecuteReader();
 
         reader.Close();
 
         reader = null;
 
         dbCommand.Dispose();
 
         dbCommand = null;
 
     }

but i figured you could probably do the same without calling it so i started to change $$anonymous$$e to look more like this

 public bool ValidInformation(string User, string Pass)
     {
         string query = "SELECT ID FRO$$anonymous$$ rz_users WHERE Username = " + User +" AND Password = " + Pass;
         
         IDbCommand dbCommand = dbConnection.CreateCommand();
         dbCommand.CommandText = query;
         IDataReader reader = dbCommand.ExecuteReader();
         
         
         return true;
         reader.Close();
         reader = null;
         dbCommand.Dispose();
         dbCommand = null;
     }

Thanks for all the help you've been giving

avatar image QuantumCD · Mar 27, 2013 at 08:53 PM 0
Share

Okay, now what you need to do is make the Username field unique so only one value can occupy it in your table. Then, check if the DataReader is null. If so, it will not have received the data. You can do this by checking the HasRows property. I believe IDataReader has this property (or something similar), but I'd recommend using SqlDataReader if you don't have to use IDataReader.

 if (dataReader.HasRows)
 {
     // There is data in the query. 
     // Since the Username is unique, 
     // you don't have to worry about more than one.
 }
 else
 {
     Debug.Log("No user with username: " + username);
 }
Show more comments

1 Reply

· Add your reply
  • Sort: 
avatar image
0
Best Answer

Answer by Bunny83 · Mar 29, 2013 at 06:56 AM

Ok just some points:

  • It seems you want to create a login-system. You never ever direct connect to a database holding user records. Every client would need your database login data, so the user can access your whole database. Nothing that prevents him from doing "select * from rz_users" or "show tables".

  • Unless you need the database for storing user related data on his own machine's MySQL server, you never want to direct connect to a database from a client.

  • Login systems should always be implemented server-side. So you need for example a webserver with PHP.

  • You have no input validation. Even without looking at your code (which can be easily decompiled) every user could use SQL injection to change / extend the actual query.

Just think about a user typing in this password:

     "my pass;DROP DATABASE"

Your query would become:

     "SELECT ID FROM rz_users WHERE Username = username AND Password = my pass;DROP DATABASE"

which are two queries, the second would be the end of your database as long as the db user has the rights to do the drop. Even if drop isn't allowed someone could simply read out all usernames and passwords.

Comment
Add comment · Show 1 · Share
10 |3000 characters needed characters left characters exceeded
▼
  • Viewable by all users
  • Viewable by moderators
  • Viewable by moderators and the original poster
  • Advanced visibility
Viewable by all users
avatar image QuantumCD · Mar 29, 2013 at 05:49 PM 0
Share

Yes, please, please, please follow Bunny83's tips unless you are connecting to a local, secure database. Even then you should obscure your credentials if possible.

Your answer

Hint: You can notify a user about this post by typing @username

Up to 2 attachments (including images) can be used with a maximum of 524.3 kB each and 1.0 MB total.

Follow this Question

Answers Answers and Comments

12 People are following this question.

avatar image avatar image avatar image avatar image avatar image avatar image avatar image avatar image avatar image avatar image avatar image avatar image

Related Questions

DLL problems for MySql 0 Answers

Distribute terrain in zones 3 Answers

Multiple Cars not working 1 Answer

Android Build dll not allowed 1 Answer

Error: Failed to set the specified COM apartment state & Canon EDSDK 0 Answers


Enterprise
Social Q&A

Social
Subscribe on YouTube social-youtube Follow on LinkedIn social-linkedin Follow on Twitter social-twitter Follow on Facebook social-facebook Follow on Instagram social-instagram

Footer

  • Purchase
    • Products
    • Subscription
    • Asset Store
    • Unity Gear
    • Resellers
  • Education
    • Students
    • Educators
    • Certification
    • Learn
    • Center of Excellence
  • Download
    • Unity
    • Beta Program
  • Unity Labs
    • Labs
    • Publications
  • Resources
    • Learn platform
    • Community
    • Documentation
    • Unity QA
    • FAQ
    • Services Status
    • Connect
  • About Unity
    • About Us
    • Blog
    • Events
    • Careers
    • Contact
    • Press
    • Partners
    • Affiliates
    • Security
Copyright © 2020 Unity Technologies
  • Legal
  • Privacy Policy
  • Cookies
  • Do Not Sell My Personal Information
  • Cookies Settings
"Unity", Unity logos, and other Unity trademarks are trademarks or registered trademarks of Unity Technologies or its affiliates in the U.S. and elsewhere (more info here). Other names or brands are trademarks of their respective owners.
  • Anonymous
  • Sign in
  • Create
  • Ask a question
  • Spaces
  • Default
  • Help Room
  • META
  • Moderators
  • Explore
  • Topics
  • Questions
  • Users
  • Badges