将SQL查询结果分配给会话变量

Question

我正在尝试根据登录的人运行SQL查询，以获取Team_ID并将其分配给会话变量。 我在将结果分配给变量时遇到麻烦。

protected void ButtonLogin_Click(object sender, EventArgs e)
{
    //check what user category was selected and login to appropriate page
    if (DropDownListUserType.SelectedIndex == 1)
    {
        SqlConnection con = new SqlConnection(ConfigurationManager.ConnectionStrings["Web_FussConnectionString"].ConnectionString);

        con.Open();
        SqlCommand cmd = new SqlCommand("select * from Team_User where Email = @username and Password_1 = @password", con);

        cmd.Parameters.AddWithValue("@username", UserName.Text);
        cmd.Parameters.AddWithValue("@password", Password.Text);

        SqlCommand cmdID = new SqlCommand("select Team_ID from Team_User where Email = @username and Password_1 = @password", con);

        cmdID.Parameters.AddWithValue("@username", UserName.Text);
        cmdID.Parameters.AddWithValue("@password", Password.Text);

        SqlDataAdapter da = new SqlDataAdapter(cmd);
        DataTable dt = new DataTable();
        da.Fill(dt);

        if (dt.Rows.Count > 0)
        {
            SqlDataReader reader = cmdID.ExecuteReader();
            int Team_ID = reader.GetInt32(1);
            Session["Team_ID"] = Team_ID;
            Response.Redirect("AddPlayer.aspx");
        }
        else
        {
            ClientScript.RegisterStartupScript(Page.GetType(), "validation", "<script language='javascript'>alert('Invalid Username and Password')</script>");
        }
    }
}

Answer 1

您的代码没有任何意义。

如果只需要Team_ID ，为什么Team_ID加载整行 ，然后再次调用数据库以仅获取Team_ID ？

我试图简化您的代码：

protected void ButtonLogin_Click(object sender, EventArgs e)
{
    // check what user category was selected and login to appropriate page
    if (DropDownListUserType.SelectedIndex == 1)
    {
        // define connection string and SQL query as strings
        string connectionString = ConfigurationManager.ConnectionStrings["Web_FussConnectionString"].ConnectionString;
        string query = "SELECT Team_ID FROM dbo.Team_User WHERE Email = @username AND Password_1 = @password";

        // set up SqlConnection and SqlCommand in "using" blocks
        using (SqlConnection con = new SqlConnection(connectionString))
        using (SqlCommand cmd = new SqlCommand(query, con))
        {
            // define and fill parameters - DO NOT use .AddWithValue!
            cmd.Parameters.Add("@username", SqlDbType.VarChar, 100).Value = UserName.Text;
            cmd.Parameters.Add("@password", SqlDbType.VarChar, 100).Value = Password.Text;

            // open connection, execute scalar, close connection
            con.Open();

            object result = cmd.ExecuteScalar();

            // if we got back a result ....
            if(result != null)
            {
                int teamID = Convert.ToInt32(result.ToString());

                Session["Team_ID"] = teamID;
                Response.Redirect("AddPlayer.aspx");
            }
            else 
            {
                // if result is NULL, then the username+password
                // were NOT found - do what needs to be done in that case here
            }
        }
    }
}