SQL Command.ExecuteReader vb.net [closed]

Question

I am trying to use a login form with SQL Express 2012 and vb.net. I have the db connection, now I have the following problem; Incorrect syntax near '=' for the code ; data = command.ExecuteReader Any suggestions? Here is the code Thanks!!!!!!!

Imports System.Data.SqlClient
Imports System.Data.OleDb


Public Class login
Private Sub login_user_Click(sender As Object, e As EventArgs) Handles login_user.Click
    Dim conn As New SqlConnection
    If conn.State = ConnectionState.Closed Then
        conn.ConnectionString = ("Server=192.168.0.2;Database=Sunshinetix;User=sa;Password=sunshine;")
    End If

    Try
        conn.Open()
        Dim sqlquery As String = "SELECT = FROM Users Where Username = '" & username_user.Text & "';"
        Dim data As SqlDataReader
        Dim adapter As New SqlDataAdapter
        Dim command As New SqlCommand
        command.CommandText = sqlquery
        command.Connection = conn
        adapter.SelectCommand = command
        data = command.ExecuteReader()
        While data.Read
            If data.HasRows = True Then
                If data(2).ToString = password_user.Text Then
                    MsgBox("Sucsess")
                Else
                    MsgBox("Login Failed! Please try again or contact support")
                End If
            Else
                MsgBox("Login Failed! Please try again or contact support")
            End If
        End While
    Catch ex As Exception

    End Try
End Sub

End Class

Answer 1

The problem was that your query is SELECT = FROM which is obviously a typo the correct syntax is SELECT * FROM.

See my code to avoid SqlInjection

Try this code:

 Dim conn As New SqlConnection
    If conn.State = ConnectionState.Closed Then
        conn.ConnectionString = ("Server=192.168.0.2;Database=Sunshinetix;User=sa;Password=sunshine;")
    End If

    Try
        conn.Open()
        Dim sqlquery As String = "SELECT * FROM Users Where Username = @user;"

        Dim data As SqlDataReader
        Dim adapter As New SqlDataAdapter
        Dim parameter As New SqlParameter
        Dim command As SqlCommand = New SqlCommand(sqlquery, conn)
        With command.Parameters
            .Add(New SqlParameter("@user", password_user.Text))
        End With
        command.Connection = conn
        adapter.SelectCommand = command
        data = command.ExecuteReader()
        While data.Read
            If data.HasRows = True Then
                If data(2).ToString = password_user.Text Then
                    MsgBox("Sucsess")
                Else
                    MsgBox("Login Failed! Please try again or contact support")
                End If
            Else
                MsgBox("Login Failed! Please try again or contact support")
            End If
        End While
    Catch ex As Exception

    End Try

I would recommend to you use the parametrized query to avoid SQL Injection

Answer 2

Change

SELECT = FROM Users ....

to

SELECT * FROM Users ....