登录时显示全名而不是用户名

Question

I've created a login window for my C# application but users logon with the username which is connected to my SQL Database but what I want is a Label which says "Welcome [Full Name]" at this moment I have a string which gets the userID from the textbox so it puts whatever the user has signed on with but I don't want the username I want the Full name which is in the table in the database.

How would I go about adding an SQL Command onto this "Welcome" label on the main window when the user logs on, it would need a "SELECT FULLNAME FROM USERS WHERE USERID='" + usernametxt.Text but how would I write the label to be connected to this SQL command result?

Answer 1

These are the steps to take:

It is most advisable to use parameters in your select statements for your login logic like others have commented to prevent sql injection. check www.w3schools.com under their sql tutorial and click to sqlinjection to understand why, here is an example though;

string txtUserId = usernametxt.Text;
string txtPassword= passwordtxt.Text;
sql = "SELECT * FROM USERS WHERE UserId= @User and 
Password= @Password";
command = new SqlCommand(sql);
command.Parameters.AddWithValue("@User",txtUserID);
command.Parameters.AddWithValue("@Password",txtPassword);
command.ExecuteReader();