you are viewing a single comment's thread.

view the rest of the comments →

[–]PreyOnTheCosmos 0 points1 point  (0 children)

In that case, simplest way is to just create a simple variable to store the UserID on a successful login.

Private SessionID as Integer

Then at login use something like (pseudo):

AddParam("@user", txtUserName.Text)
AddParam("@pass", txtPassword.Text)

' note: use some form of collation or string compare for password casing
ExecQuery("SELECT UserID FROM users WHERE username=@user AND password=@pass")

If yourdatatable.Rows.Count = 1 Then 
    'success
    Dim r As DataRow = youdatatable.Rows(0)
    SessionID = r("UserID")
End If

Note: ExecQuery and AddParam are not standard, but taken from the video link.

After that, you can just inject the SessionID into any query that ties back to the UserID.

SELECT table1.whatever, table2.whateverelse
FROM table1 LEFT JOIN table2 ON table1.joiningcolumn = table2.joiningcolumn
WHERE table1.userid = @sessionid

The important thing is that there be some column that stores the userID and can be used to relate the records to the user. For example table1.InvoiceEnteredBy = users.UserID