登录时显示全名而不是用户名

Question

I've created a login window for my C# application but users logon with the username which is connected to my SQL Database but what I want is a Label which says "Welcome [Full Name]" at this moment I have a string which gets the来自文本框中的用户 ID，因此它会放置用户已登录的任何内容，但我不想要用户名，我想要数据库表中的全名。

How would I go about adding an SQL Command onto this "Welcome" label on the main window when the user logs on, it would need a "SELECT FULLNAME FROM USERS WHERE USERID='" + usernametxt.Text but how would I write the label要连接到这个 SQL 命令结果？

Answer 1

这些是要采取的步骤：

最好在您的 select 语句中为您的登录逻辑使用参数，就像其他人评论的那样，以防止 sql 注入。 在他们的 sql 教程下查看 www.w3schools.com 并单击 sqlinjection 以了解原因，但这里是一个示例；

string txtUserId = usernametxt.Text;
string txtPassword= passwordtxt.Text;
sql = "SELECT * FROM USERS WHERE UserId= @User and 
Password= @Password";
command = new SqlCommand(sql);
command.Parameters.AddWithValue("@User",txtUserID);
command.Parameters.AddWithValue("@Password",txtPassword);
command.ExecuteReader();