“填写：SelectCommand.Connection 属性尚未初始化。”

Question

I am using a visual studio 2022 vb.net and mssql management studio.

login form

Private Sub Btnlogin_Click(sender As Object, e As EventArgs) Handles Btnlogin.Click
    cn.Open()
    cm = New SqlClient.SqlCommand("select * from table_user where username like '" & username.Text & "' and password like '" & password.Text & "'and usertype=   '" & usertype.SelectedItem & "'", cn)
    dr = cm.ExecuteReader
    sda.Fill(dt)
    If (dt.Rows.Count > 0) Then
        MessageBox.Show("You are login as " + dt.Rows(0)(2))
        If (usertype.SelectedIndex = 0) Then
            Dim a As New dashboard
            a.Show()
            Me.Hide()
        Else
            Dim b As New Admin
            b.Show()
            Me.Hide()
        End If
    Else
        MessageBox.Show("Username or Password Incorrect. CONTACT ADMINISTRATOR!")
    End If
    cn.Close()
End Sub

Module

Imports System.Data.SqlClient

Module Module1
    Public cn As New SqlConnection("Data Source=DESKTOP-7POF5HE\SQLEXPRESS;Initial Catalog=dict;Integrated Security=True")
    Public cm As New SqlCommand
    Public dr As SqlDataReader
    Public sda As SqlDataAdapter = New SqlDataAdapter(cm)
    Public dt As DataTable = New DataTable()
End Module

CAN YOU HELP ME TO SOLVE THIS?

Answer 1

Seems there are several issues with this code.

In your module, you create the command object and the data adapter object. But in the form method, you create a new command object. But that will not update the data adapter to use that new command object. Class variables are reference types. They just point to an object in the memory somewhere. Your cm variable will point to the new command object, but your sda object will internally still point to the old command object.

Furthermore:

1. You are using both a data reader and a data adapter. Both have their pros and cons, but you probably don't need (or want) to use them both at the same time. I assume you want to use the data adapter. So you can drop the dr = cm.ExecuteReader line in the form method.

2. Since you will probably always want to create command objects and data adapter objects on the fly (as I would), you could remove them from the module. Just create them both as local variables in your form method.

3. Try to use the Using statement for such objects. They need to be disposed of nicely when the form method finishes. Otherwise they might keep valuable system resources in use until the .NET garbage collector disposes them (which will probably occur when you close your application, not earlier).

4. Also be careful with concatenating SQL statements from variables. What would happen here if you enter this text in your username textbox?: ';delete from table_user;--
   Hint: Do not actually try it! It will try to delete all your users from the database table table_user . Just try to manually reproduce the SQL string that will be built in your form method. This is called an SQL injection attack . To avoid such nasty things, it's easiest to use SQL parameters in your SQL statements and pass them separately to your command object.