为什么ADO.NET仍然使用错误的用户连接到SQL Server？

Question

I am running Microsoft SQL Server 2014. I try to connect to SQL Server using ADO.NET in a C# application. My connection string is:

var myConnection = new SqlConnection("Data
 Source=VIRTUAL-ADMIN\\SQLEXPRESS;" +
                 "Integrated Security=SSPI;" +
                 "Initial Catalog=StudentManagement;"+
                 "User id=...;"+
                "Password=...");

My Initial Catalog is a right and existed database. But my username is a wrong username! The Password I have inserted is also wrong already. But ADO.NET still connected to my database and I can execute query and do everything with my database. How can I fix it?

Answer 1

You have provided both Integrated Security=SSPI; as well as username & password so it by default takes integrated Security ie windows authentication and thus you are able to connect with wrong credentials as well.

So, either user Integrated Security or your credentials as you do when connecting to SSMS, when it asks for either Windows authentication or SQL Server authentication

From MSDN :-

Integrated Security When false, User ID and Password are specified in the connection. When true, the current Windows account credentials are used for authentication.