Trying to create a one user program that is password protected

Question

I am working on creating a C# application that will allow the one and only user to create an account with user name and password. So only this user can access it. As it sits now I have it connected to a local SQL database with a table for login information. I have a form where the user can create an account. It will send the info to the table. I have a log in page that will authenticate against the table before letting the user on to the main.cs However, as it stands....anyone that opens the application can create log in credentials and access it. Is there a way I can make the application, when started the first time run through an initial account creation or set up then open directly to the log in page after? I am looking for a better way to secure it.

EXAMPLE: This app will keep an inventory for me for items I own. But I want to password protect it. However, I want to make it so that not everyone that starts up the application can create an account and access this information. I am trying to make it so that the user (myself) can set up a password via a form. Then, from that point on be able to access the application via that password.

LOGIN FORM:

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Data.SqlClient;

namespace WindowsFormsApplication2
{
public partial class LoginForm : Form
{
    public LoginForm()
    {
        InitializeComponent();
    }

    private void button2_Click(object sender, EventArgs e)
    {
        this.Close();
    }

    private void button1_Click(object sender, EventArgs e)
    {

        SqlConnection con = new SqlConnection(@"Data Source=.\SQLEXPRESS;AttachDbFilename=C:\Users\brmcbrid\Documents\UserLogin.mdf;Integrated Security=True;Connect Timeout=30;User Instance=True");
        SqlDataAdapter sda = new SqlDataAdapter("Select Count(*) From Login where Username='" + userName.Text + "' and Password = '" + password.Text + "'", con);
        DataTable dt = new DataTable();
        sda.Fill(dt);
        if (dt.Rows[0][0].ToString() == "1")
        {
            this.Hide();
            Main wipd = new Main();
            wipd.Show();
        }
        else
        {
            MessageBox.Show("Please Check your username and password and try again.");
        }
    }

    private void linkLabel1_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e)
    {
        this.Hide();
        CreateNewAccount na = new CreateNewAccount();
        na.Show();
    }
}
}

REGISTRATION FORM:

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Drawing;
using System.Linq;
using System.Text;
using System.Windows.Forms;
using System.Data.SqlClient;
using System.Data.Sql;

namespace WindowsFormsApplication2
{
public partial class CreateNewAccount : Form
{
    public CreateNewAccount()
    {
        InitializeComponent();
    }

    private void button2_Click(object sender, EventArgs e)
    {
        this.Close();
        LoginForm lf = new LoginForm();
        lf.Show();
    }

    private void button1_Click(object sender, EventArgs e)
    {

        //instance of sqlconnection
        SqlConnection con = new SqlConnection(@"Data Source=.\SQLEXPRESS;AttachDbFilename=C:\Users\brmcbrid\Documents\UserLogin.mdf;Integrated Security=True;Connect Timeout=30;User Instance=True");
        SqlCommand cmd = new SqlCommand("INSERT into LOGIN values('" + newUserName.Text + "','" + newPassword.Text + "','" + firstName.Text + "','" + lastName.Text + "','" + newEmail.Text + "')", con);
        con.Open();
        int i = cmd.ExecuteNonQuery();
        con.Close();
        if (i > 0)
        {
            this.Hide();
            LoginForm lf = new LoginForm();
            lf.Show();
            MessageBox.Show("New User Account added successfully!");
        }
        else
        {
            MessageBox.Show("There was a problem creating the account.  Please check the values and try again.");
        }


    }



}
}

Answer 1

A good solution (though certainly not tamper proof) would be to check your users table for any existing records before going to the account creation screen.

I would do a flow like this:

1. Startup/splash screen runs a "SELECT" query on the users table:
2. Check if the row count is 0
3. If it is, go to the registration page

4. If its not, go to the login page

   SqlDataAdapter sda = new SqlDataAdapter("Select Count(*) From Login", con);
   DataTable dt = new DataTable();
   sda.Fill(dt);
   if (dt.Rows[0][0].ToString() == "0")
   {
       RegistrationForm rf = new RegistrationForm();
       rf.Show();
   }
   else
   {
       this.Hide();
       LoginForm lf = new LoginForm();
       lf.Show();
   }