[Solved] ASP.NET Login, invalid password

Question

EDIT

Now that I look closer there are many things wrong with this code. Standard practice is to check for the username/password combination in one shot:

mysql = "SELECT 1 FROM [User] WHERE UserName=? AND Password=?";
OleDbCommand CheckUser = new OleDbCommand(mysql, con);
// Add OleDbParameters here with the correct type/length
CheckUser.Parameters.Add("@userName", OleDbType.Char, 20).Value = tbUser.Text ;
CheckUser.Parameters.Add("@password", OleDbType.Char, 20).Value = tbPass.Text ;

int temp = Convert.ToInt32(CheckUser.ExecuteScalar().ToString());

and adding parameters to the command with the username and password values. That way hackers can’t determine valid usernames without knowing the password.

This block:

    mysql2 = "SELECT * FROM [User] WHERE Password='" + tbPass.Text + "'";
    OleDbCommand Pass = new OleDbCommand(mysql2, con);
    string Password = Pass.ExecuteScalar().ToString();

Will return the first column form the first row of the result set. Unless Password is the first column in the User table, you’re not getting the password back, you’re getting some other value.

It could be:

    mysql2 = "SELECT password FROM [User] WHERE Password='" + tbPass.Text + "'";
    OleDbCommand Pass = new OleDbCommand(mysql2, con);
    string Password = Pass.ExecuteScalar().ToString();

Accepted Answer