Oracle select 查询是 C# 中的无效数字

Question

I have a code that I use to login. I call the data I get from textbox with a method and check the records with select query in the database.

I call to relevant method, when I press the button.

 private void btnGiris_Click(object sender, EventArgs e)
        {
            LoginBilgiler lb = new LoginBilgiler();
            bool sonuc = lb.GirisKontrol(txtAd.Text, txtSifre.Text);
        }

But I encounter errors in cmd.ExecuteReader the below.

    public bool GirisKontrol(string ad,string sifre)
    {
        using (OracleConnection con = new OracleConnection(connectionString))
        {


            string query = String.Format("SELECT count(*) from Z_LABEL_USER where USERNAME=({0}) and PASSWORD=({1})", ad,sifre);
            OracleCommand cmd = new OracleCommand(query, con);
            con.Open();
            OracleDataReader dr = cmd.ExecuteReader();
          
            if (dr.HasRows)
            {
                kAdi = ad;
                con.Close();
                return true;
            }
            else
                con.Close();
                return false;
        }
    }

The table I use for the select query.

Oracle.ManagedDataAccess.Client.OracleException: 'ORA-01722: invalid number'

Answer 1

Please, don't hardcode parameters in SQL; parametrize it instead:

public bool GirisKontrol(string ad, string sifre) {
  //DONE: validate public methods' input
  if (string.IsNullOrEmpty(ad))
    return false; // or throw exception
  else if (string.IsNullOrEmpty(sifre))
    return false; // or throw exception

  using (OracleConnection con = new OracleConnection(connectionString)) {
    con.Open();

    //DONE: no need to count all the entires, just check if there's at least one 
    //DONE: keep query readable
    //DONE: paramterize queries   
    string query = 
      @"select 1 
          from Z_LABEL_USER 
         where USERNAME = :prm_UserName 
           and PASSWORD = :prm_Password";
    
    using (OracleCommand cmd = new OracleCommand(query, con)) {
      //TODO: this syntax can vary from library to library you use to work with Oracle
      cmd.Parameters.Add(":prm_UserName", OracleType.VarChar).Value = ad;
      cmd.Parameters.Add(":prm_Password", OracleType.VarChar).Value = sifre;

      using (OracleDataReader dr = cmd.ExecuteReader()) {
        if (dr.Read()) {
          //TODO: Side effect : it changes instance's state. Do you really want it?
          kAdi = ad;

          return true;
        }  
      }
    } 
  }
 
  return false;
}