VB.NET SQL limit submission attempts - asp.net

Question

I have a submission page that I need to limit the number of attempts that a user can try in a specific time period.
There is a stored procedure that is called that checks for certain data in database1 and also logs the IP address and the date/time the form was submitted into database2.
All I need to do is check how many attempts have been logged by that IP address within a 30 minute time period and restrict further submission attempts if that number is over 5.
Here is my VB code:
Protected Sub btn_Cont_Click(sender As Object, e As EventArgs) Handles btn_Cont.Click
Dim StudentIDLast4 As Integer = Val(textSSN.Text)
Dim StudentIDInst As String = textSID.Text.ToUpper
Dim DateOfBirth As String = textDOB.Text
Dim IPaddress As String = Request.UserHostAddress()
Dim sqlConnection1 As New SqlConnection("Data Source=(localdb)\v11.0;Initial Catalog=tempdb;Integrated Security=True")
Dim cmd As New SqlCommand
Dim returnValue As String
Dim returnCount As Integer
cmd.CommandText = "proc_ReverseTransferConsent_Find_Match"
cmd.CommandType = CommandType.StoredProcedure
cmd.Parameters.AddWithValue("#StudentIDLast4", StudentIDLast4)
cmd.Parameters.AddWithValue("#StudentIDInst", StudentIDInst)
cmd.Parameters.AddWithValue("#DateOfBirth", DateOfBirth)
cmd.Parameters.AddWithValue("#IPaddress", IPaddress)
cmd.Connection = sqlConnection1
Dim sqlConnection2 As New SqlConnection("Data Source=(localdb)\v11.0;Initial Catalog=tempdb;Integrated Security=True")
Dim attempts As String
Dim comm As New SqlCommand("SELECT [Count] = COUNT(*) FROM ReverseTransferConsent_Attempt WHERE IPaddress = #IPaddress AND CreatedDate > DATEADD(MINUTE, -30, GETDATE())")
Dim ap As New SqlDataAdapter(comm.CommandText, sqlConnection1)
Dim ds As New DataSet()
comm.Parameters.AddWithValue("#IPaddress", IPaddress)
If Page.IsValid Then
sqlConnection2.Open()
ap.Fill(ds)
attempts = ds.Tables(0).Rows.Count.ToString()
sqlConnection2.Close()
sqlConnection1.Open()
returnValue = Convert.ToString(cmd.ExecuteScalar())
sqlConnection1.Close()
returnCount = returnValue.Length
If attempts <= 5 Then
If returnCount > 4 Then
Response.Redirect("RTAgreement.aspx?rVal=" + returnValue)
Else
Label2.Text = StudentIDInst
End If
ElseIf attempts > 5 Then
Label2.Text = "Only 5 submission attempts allowed per 30 minutes"
End If
End If
End Sub
It's giving me the error:
An exception of type 'System.Data.SqlClient.SqlException' occurred in System.Data.dll but was not handled in user code
Additional information: Must declare the scalar variable "#IPaddress".
I declared the variable using AddWithValue. Is that not correct?

Answer 1

The problem is that you instantiate your SqlDataAdapter using command text only (passing the query but not parameters) so it doesn't have the parameter passed:
Dim ap As New SqlDataAdapter(comm.CommandText, sqlConnection1)
you should use the command instead and instantiate your command passing the connection as well:
Dim comm As New SqlCommand("SELECT [Count] = COUNT(*) FROM ReverseTransferConsent_Attempt WHERE IPaddress = #IPaddress AND CreatedDate > DATEADD(MINUTE, -30, GETDATE())", sqlConnection1)
Dim ap As New SqlDataAdapter(comm)

Answer 2

You might have an instance of SQL Server will be case sensitive. Can you check how IPAddress parameter is defined in proc_ReverseTransferConsent_Find_Match stored procedure?

Answer 3

Just for reference for anyone else who may have a similar issue or might be trying to accomplish the same task that finds this thread.
This is what I had to do to get it to count properly and not return 1 every time:
Dim sqlConnection2 As New SqlConnection("Data Source=(localdb)\v11.0;Initial Catalog=tempdb;Integrated Security=True")
Dim attempts As String = ""
Dim comm As New SqlCommand("SELECT [Count] = COUNT(*) FROM ReverseTransferConsent_Attempt WHERE IPaddress = #IPaddress AND CreatedDate > DATEADD(MINUTE, -30, GETDATE())", sqlConnection1)
comm.Parameters.AddWithValue("#IPaddress", IPaddress)
comm.Connection = sqlConnection2
If Page.IsValid Then
sqlConnection2.Open()
attempts = Convert.ToString(comm.ExecuteScalar())
sqlConnection2.Close()