title: Why is my response always 0 after using parameters in OleDB?
body: <p>I have a simple .aspx login website and I use OleDB for local validation. </p>
  
  <p>Here is my problem: After finding SQL Injection vulnerability, I decided to use parameters. But after using parameters my response is always "0" (Same as "Authenticated=false"). But if I don't use parameters, my response is "1" (Same as "Authenticated=true").</p>
  
  <p>Here some pics while debugging:</p>
  
  <p>Without parameters where the response=1 (Authenticated):
  <a href="https://i.stack.imgur.com/zTTmA.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/zTTmA.jpg" alt="Without parameters"></a> </p>
  
  <p>With code:</p>
  
  <pre><code>string idstr = Request.QueryString["id"];
              idstr.Replace("''", "");
              string passpath = Request.QueryString["password"];
              passpath.Replace("''", "");
  
              OleDbConnection connect = new OleDbConnection();
              OleDbCommand cmd = new OleDbCommand();
              connect.ConnectionString = @"Provider=Microsoft.ACE.OLEDB.12.0; Data Source= C:\Users\hugow_000\Desktop\OSGS_Kantine_htm_design\Kantine_data.accdb; Persist Security Info = False;";
              cmd.Connection = connect;
              connect.Open();
              cmd.CommandText = "select * from User_data where Stamnummer="+idstr+" and Wachtwoord="+ passpath;
  
              OleDbDataReader read = cmd.ExecuteReader();
              int code = 0;
              while (read.Read())
              {
                  code = code + 1;
              }
              if (code == 1)
              {
                  Response.Redirect("~/AuthKeyGEN.aspx?Auth=true&amp;id=" + idstr + "&amp;password=" + passpath + "");
  
              }
              if (code &gt; 1)
              {
                  Response.Redirect("~/Login.aspx?response=0");
              }
              if (code &lt; 1)
              {
                  Response.Redirect("~/Login.aspx?response=0");
              }
          }
  </code></pre>
  
  <p>And with parameters where the response is 0 (Not Authenticated):
  <a href="https://i.stack.imgur.com/pW2o4.jpg" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/pW2o4.jpg" alt="With parameters"></a></p>
  
  <p>And with code:</p>
  
  <pre><code>string idstr = Request.QueryString["id"];
              idstr.Replace("''", "");
              string passpath = Request.QueryString["password"];
              passpath.Replace("''", "");
  
              OleDbConnection connect = new OleDbConnection();
              OleDbCommand cmd = new OleDbCommand();
              connect.ConnectionString = @"Provider=Microsoft.ACE.OLEDB.12.0; Data Source= C:\Users\hugow_000\Desktop\OSGS_Kantine_htm_design\Kantine_data.accdb; Persist Security Info = False;";
              cmd.Connection = connect;
              connect.Open();
              cmd.CommandText = "select * from User_data where Stamnummer=@idstr and Wachtwoord=@passpath";
              cmd.Parameters.Add("@idstr", OleDbType.BSTR).Value = idstr;
              cmd.Parameters.Add("@passpath", OleDbType.BSTR).Value = passpath;
  
              OleDbDataReader read = cmd.ExecuteReader();
              int code = 0;
              while (read.Read())
              {
                  code = code + 1;
              }
              if (code == 1)
              {
                  Response.Redirect("~/AuthKeyGEN.aspx?Auth=true&amp;id=" + idstr + "&amp;password=" + passpath + "");
  
              }
              if (code &gt; 1)
              {
                  Response.Redirect("~/Login.aspx?response=0");
              }
              if (code &lt; 1)
              {
                  Response.Redirect("~/Login.aspx?response=0");
              }
          }
  </code></pre>
  
  <p>I am using the same credentials in both scenarios,
  So why is my response always 0 if I use parameters in here? </p>
  
  <p>Thanks in advance!</p>