如何从mysql数据库中检索数据

Question

此代码来自我们SAD项目的用户登录配置文件。我注册用户登录的帐户正在运行，因为它保存在数据库中，但我无法登录，因为它说无效。

private void btn_login_Click(object sender, EventArgs e) 
     { 
      conn = new MySqlConnection(myconn); 
      string query = "select * from southpoint_school.user where userUsername='" + textBox1.Text + "' and userPassword='" + textBox2.Text + "'"; 
      conn.Open(); 
      cmd = new MySqlCommand(query, conn); 

     MySqlDataReader reader = cmd.ExecuteReader(); 
     int count = 0; 

     while (reader.Read()) 
     { 
      count++; 
     } 

     if (count == 1) 
     { 
      conn = new MySqlConnection(myconn); 

      string problem = "SELECT userAccountType from southpoint_school.user WHERE userUsername ='" + textBox1.Text + "'"; 
      conn.Open(); 
      cmd = new MySqlCommand(problem, conn); 
      string answer = cmd.ExecuteScalar().ToString(); 
      conn.Close(); 

      MessageBox.Show("Login successful!", "Success!", MessageBoxButtons.OK, MessageBoxIcon.Information); 

      if (answer == "Administrator") 
      { 
       memorable = "Administrator"; 

       frm_main main = new frm_main(); 
       main.Show(); 
       this.Hide(); 
      } 
      else 
      { 
       memorable = "Limited"; 

       frm_main main = new frm_main(); 
       main.Show(); 
       this.Hide(); 
      } 
     } 
     else if (textBox1.Text == "" && textBox2.Text == "") 
     { 
      MessageBox.Show("No Username and/or Password Found!"); 
     } 
     else 
     { 
      MessageBox.Show("Invalid Username And/Or Password!"); 
     } 
     conn.Close(); 
    } 

Answer 1

的情况下

无效的用户名和/或密码！

只有当您输入的用户名和密码在您的southpoint_school.user数据库中有0个或多于1个搜索结果时才会发生。所以我会检查数据库中的数据。

此外，我会

• 使用的参数，而不是字符串串联创建SQL语句，以避免注射
• 保存（咸）哈希密码，而不是明文使用语句进行更数据库
• 使用有效的修复用途
• 仅查询一次用户表并使用结果两次

例如：

if (string.IsNullOrEmpty(textBox1.Text) || string.IsNullOrEmpty(textBox2.Text)) 
{ 
    MessageBox.Show("No Username and/or Password Found!"); 
} 
else 
{ 
    DataTable dtResult = new DataTable(); 
    string Command = "select * from southpoint_school.user where userUsername=@un and userPassword=@up"; 
    using (MySqlConnection myConnection = new MySqlConnection(ConnectionString)) 
    { 

     using (MySqlDataAdapter myDataAdapter = new MySqlDataAdapter(Command, myConnection)) 
     { 
      myDataAdapter.SelectCommand.Parameters.Add(new MySqlParameter("@un", textBox1.Text)); 
      myDataAdapter.SelectCommand.Parameters.Add(new MySqlParameter("@up", textBox2.Text)); 
      myDataAdapter.Fill(dtResult); 
     } 
    } 
    if (dtResult.Rows.Count == 1) 
    { 
     MessageBox.Show("Login successful!", "Success!", MessageBoxButtons.OK, MessageBoxIcon.Information); 
     if ((string)dtResult.Rows[0]["userAccountType"] == "Administrator") 
     { 
      memorable = "Administrator"; 
      frm_main main = new frm_main(); 
      main.Show(); 
      this.Hide(); 
     } 
     else 
     { 
      memorable = "Limited"; 
      frm_main main = new frm_main(); 
      main.Show(); 
      this.Hide(); 
     } 
    } 
    else if (dtResult.Rows.Count == 0) 
    { 
     MessageBox.Show("Invalid Username And/Or Password!"); 
    } 
    else //TODO: treat the case for multiple results 
    { 
    } 
}