Today's Code Snippet comes from Christopher Stolworthy. Christopher has a friend who is attending an upstanding college to get his Bachelors of Science in Computer Science. One day this friend called him up... "He wanted me to test out his new login system that he had written in C#, using SQL Server. I agreed and he sent me his app. I was playing around with it when I noticed something interesting. After typing in my username I would begin to type my password, if I mistyped a character ANYWHERE in the field the app immediately threw an error. "This is interesting" I thought to myself. So I dove into the code, after a few minutes I found the following. He couldn't see where the security issue was, until I used "Admin" as the username and started guessing his password."

private void txtHostname_KeyPress(object sender, KeyPressEventArgs e)
{
   StringBuilder sb = new StringBuilder();
   sb.Append("SELECT Passwd FROM [Users] WHERE Username='");
   sb.Append(this.txtUsername.Text + "'");

   String password = GetPassword(sb.ToString());

   for (int i = 0; i < (sender as TextBox).Text.Length; i++)
   {
       if (password[i] == (sender as TextBox).Text[i])
       {
           this.lblError.Text = "";
       }
       else
       {
           this.lblError.Text = "Incorrect Password!";
       }

       if (i == (sender as TextBox).Text.Length)
       {
           if (password[i] == (sender as TextBox).Text[i])
           {
               LogUserIn(this.txtUsername.Text);
           }
       }
   }
}
[Advertisement] BuildMaster allows you to create a self-service release management platform that allows different teams to manage their applications. Explore how!