如何在 asp.net c# 中对电子邮件和联系人（相同的 TextBox）使用多客户端验证？

Question

how to use one TextBox and multiple validations i tried this

private Boolean checkemail() // for checking email in database    
{
    SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString);//sql connection string
    Boolean emailavailable = false;
    String myquery = "Select * from [test].[dbo].[MYFORM] where email='"+ TXTEmail.Text+"'";

    SqlCommand cmd = new SqlCommand();
    cmd.CommandText = myquery;
    cmd.Connection = conn;
    SqlDataAdapter da = new SqlDataAdapter();
    da.SelectCommand = cmd;
    DataSet ds = new DataSet(); //dataset
    da.Fill(ds);
    if (ds.Tables[0].Rows.Count > 0)
    {
        emailavailable = true;
    }
    conn.Close();
    return emailavailable;
}

c# code for the email check in database

Answer 1

First point: let's get back to the basics: js validation

Server side validation is performed by a web server, after input has been sent to the server.

Client side validation is performed by a web browser, before input is sent to a web server.

For example: Client side validation would include email formating (is it a valid email?) and checks like empty fields that the server needs etc.

Server side validation would check that the email is not yet used in another form by another user (like your case here) and it occurs in your backend system.

Second point: SqlInjection. As mentioned in the comments, use parameters for sql sanitization. It's a pretty basic exploit.

private Boolean checkemail() // for checking email in database    
{
    SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["ConnectionString"].ConnectionString);//sql connection string
    Boolean emailavailable = false;
    String myquery = "Select * from [test].[dbo].[MYFORM] where email = @email";

    SqlCommand cmd = new SqlCommand();
    cmd.Parameters.Add("@email", SqlDbType.Text);
    cmd.Parameters["@email"].Value = TXTEmail.Text;
    cmd.CommandText = myquery;
    cmd.Connection = conn;
    SqlDataAdapter da = new SqlDataAdapter();
    da.SelectCommand = cmd;
    DataSet ds = new DataSet(); //dataset
    da.Fill(ds);
    if (ds.Tables[0].Rows.Count > 0)
    {
        emailavailable = true;
    }
    conn.Close();
    return emailavailable;
}

Third point: Multiple checks

If I understand what you are saying, you want to query with two parameters. Use the sql or operator like this:

String myquery = "Select * from [test].[dbo].[MYFORM] where email = @email or contact = @contact";
cmd.Parameters.Add("@email", SqlDbType.Text);
cmd.Parameters["@email"].Value = TXTEmail.Text;
cmd.Parameters.Add("@contact ", SqlDbType.Text);
cmd.Parameters["@contact "].Value = TXTEmail.Text;