Get Specific data from access database - asp.net

Question

I have a login form which require two fields. One is for email and other is password. I want to get email and password from database and then match it with user entered email and password.
So far I have done this.
public int checkLogin(String email,String pass)
{
try
{
conn = new OleDbConnection();
cmd = new OleDbCommand();
da = new OleDbDataAdapter();
ds = new DataSet();
conn.ConnectionString = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source=E:\\Users\\He Man\\Documents\\Project.accdb";
conn.Open();
cmd.CommandText = "SELECT Email, [Password] FROM UserProfile"
+" where Email='"+email+"' and Password='"+pass+"';";
int checkPoint=0;
da.SelectCommand = cmd;
da.Fill(ds);
for (int i = 0; i < ds.Tables["UserProfile"].Rows.Count; i++)
{
if (ds.Tables["UserProfile"].Rows[i]["Email"].ToString() == email && ds.Tables["UserProfile"].Rows[i]["[Password]"].ToString() == pass)
{
checkPoint = 1;
}
else
{
checkPoint =0;
}
}
conn.Close();
return checkPoint;
}
catch(Exception)
{
return 0;
}
}
It returns 1 if data match and 0 if didn't match kindly help. I just wanted to match my data to each data value in the dataset.

Answer 1

You are doing too many things wrong.
you absolutely don't need to do this
if (ds.Tables["UserProfile"].Rows[i]["Email"].ToString() == email ...
because, your query has a where condition, i.e. if the Username and password won't match, your DataSet is going to be empty, so you should better check, whether your ds is empty or not.
You are prone to SQL Injection. A 7th Grade kid can drop your entire database. Do NOT USE Concatenated string as your command query, use parameterized one, i.e.
query = "Select Count(*) From UserProfile Where Username= #username and
Password=#password";
OleDbCommand cmd = new OleDbCommand(query, conn);
cmd.Parameters.AddWithValue("#username", txtUsername.Text);
cmd.Parameters.AddWithValue("#password", txtPassword.Text);
int result = (int)cmd.ExecuteScalar();
if(result.Equals(1))
{
//successful login
}
else
{
//login failed
}
you should'nt be creating Connection and Command object everywhere, you can create class wrapping all these db-details and exposing functions accepting only querystring and parameters as arguments and returning dataset or scalar result, something like:
public DataTable GetSelectQueryResult(string query, OleDbParameter[] parameters)
{
var con = GetConnection();
//rest of the logic
}

Answer 2

replace this:
for (int i = 0; i < ds.Tables["UserProfile"].Rows.Count; i++)
{
if (ds.Tables["UserProfile"].Rows[i]["Email"].ToString() == email && ds.Tables["UserProfile"].Rows[i]["[Password]"].ToString() == pass)
{
checkPoint = 1;
}
else
{
checkPoint = 0;
}
}
with:
checkPoint = ds.Tables["UserProfile"].Rows.Count>0 ? 1 : 0;