为什么登录控件C＃为任何用户名和密码提供身份验证

Question

I'm creating a login form that gives authentications to usernames and passwords from a database created, the code is run without an error but when writing any username or password even it is not exist the database it logs in, I need it to give authentications and make only the database usernames to login..

    using System;
    using System.Collections.Generic;
    using System.Linq;
    using System.Web;
    using System.Web.UI;
    using System.Web.UI.WebControls;
    using System.Web.Configuration;
    using System.Data;
    using System.Data.SqlClient;

    namespace WebApplication1
    {
        public partial class LoginTest : System.Web.UI.Page
        {
            private string strcon = WebConfigurationManager.ConnectionStrings["myConnectionString"].ConnectionString;
            protected void Page_Load(object sender, EventArgs e)
            {
                this.UnobtrusiveValidationMode = System.Web.UI.UnobtrusiveValidationMode.None;
            }
            private bool UserLogin(string un, string pw)
            {
                SqlConnection conn = new SqlConnection(strcon);
                SqlCommand cmd = new SqlCommand("Select id from student where id=@un and Password=@pw", conn);
                cmd.Parameters.AddWithValue("@un", un);
                cmd.Parameters.AddWithValue("@pw", pw);
                conn.Open();
                string result = Convert.ToString(cmd.ExecuteScalarAsync());
                if (String.IsNullOrEmpty(result)) return false; return true;

            }
            protected void Login1_Authenticate(object sender, AuthenticateEventArgs e)
            {
                string un = Login1.UserName;
                string pw = Login1.Password;
                bool result = UserLogin(un, pw);
                if (result)
                {
                    e.Authenticated = true;
                    Session["username"] = un;

                }
                else e.Authenticated = false;
            }
        }
    }

Answer 1

cmd.ExecuteScalarAsync() returns a Task object. Converting that to a string will always succeed; it will create a string that is "System.Threading.Tasks.Task", which is certainly not empty, or null.

You need to await the call to ExecuteScalarAsync() , or you need to call ExecuteScalarAsync().Result , which will block until the query operation is complete.

Additionally , please make sure any app you are making - even if you think it is a toy - is using proper one-way hashing of passwords. There is plenty of advice here on Stackoverflow and elsewhere for how to securely store passwords.