使用ASP.Net检查用户名是否在数据库中

Question

I want to check if a username is already in the database. It comes along with my update statement. I have this code and I do not know where to put the select statement:

protected void btn_update_Click(object sender, EventArgs e)
{
    SqlConnection con = new SqlConnection(conn);
    con.Open();

    str = "update UserData set Password=@Password where UserName='" + txtUser.Text + "'";

    com = new SqlCommand(str, con);

    com.Parameters.Add(new SqlParameter("@Password", SqlDbType.VarChar));
    com.Parameters["@Password"].Value = BusinessLayer.ShoppingCart.CreateSHAHash(txtPW.Text);

    com.ExecuteNonQuery();

    con.Close();
    Label1.Visible = true;
    Label1.Text = "Password changed Successfully!" ;

    con.Close();
}

I want something like

"Select Username from Userdata Where Username = txtUser.Text"

Answer 1

You don't need a SELECT here. ExecuteNonQuery() returns the number of rows affected, which means that when it returns 0, there was no user with the given name in the database. If all went well, it should return 1.

Your code is vulnerable to SQL injection and leaks resources. Here's a better version:

protected void btn_update_Click(object sender, EventArgs e)
{
    using(var con = new SqlConnection(conn))
    {        
        con.Open();
        var commandTest = "update UserData set Password=@Password where UserName=@Username";

        using(var com = new SqlCommand(commandTest, con))
        {
            com.Parameters.AddWithValue("@Username", txtUser.Text);
            com.Parameters.AddWithValue("@Password", BusinessLayer.ShoppingCart.CreateSHAHash(txtPW.Text));

            if(com.ExecuteNonQuery() == 1)
            {
                Label1.Visible = true;
                Label1.Text = "Password changed Successfully!" ;            
            }
        }
    }
}