如何從mysql數據庫中檢索數據

Question

此代碼來自我們 SAD 項目的用戶登錄配置文件。 我為用戶登錄注冊的帳戶正在工作，因為它保存在數據庫中，但我無法登錄，因為它說無效。

private void btn_login_Click(object sender, EventArgs e)
        {
            conn = new MySqlConnection(myconn);
            string query = "select * from southpoint_school.user where userUsername='" + textBox1.Text + "' and userPassword='" + textBox2.Text + "'";
            conn.Open();
           cmd = new MySqlCommand(query, conn);

       MySqlDataReader reader = cmd.ExecuteReader();
        int count = 0;

        while (reader.Read())
        {
            count++;
        }

        if (count == 1)
        {
            conn = new  MySqlConnection(myconn);

            string problem = "SELECT userAccountType from southpoint_school.user WHERE userUsername ='" + textBox1.Text + "'";
            conn.Open();
            cmd = new MySqlCommand(problem, conn);
            string answer = cmd.ExecuteScalar().ToString();
            conn.Close();

            MessageBox.Show("Login successful!", "Success!", MessageBoxButtons.OK, MessageBoxIcon.Information);

            if (answer == "Administrator")
            {
                memorable = "Administrator";

                frm_main main = new frm_main();
                main.Show();
                this.Hide();
            }
            else
            {
                memorable = "Limited";

                frm_main main = new frm_main();
                main.Show();
                this.Hide();
            }
        }
        else if (textBox1.Text == "" && textBox2.Text == "")
        {
            MessageBox.Show("No Username and/or Password Found!");
        }
        else
        {
            MessageBox.Show("Invalid Username And/Or Password!");
        }
        conn.Close();
    }

Answer 1

案子

無效的用戶名和/或密碼！

僅當您使用輸入的用戶名 + 密碼在southpoint_school.user數據庫中有 0 個或 1 個以上的搜索結果時才會發生。 所以我會檢查你數據庫中的數據。

另外我會

• 使用參數而不是字符串連接來創建 sql 語句以避免注入
• 在您的數據庫中保存（加鹽）散列密碼而不是明文
• 使用 using 語句以獲得更有效的資源使用
• 僅查詢用戶表一次並使用結果兩次

例如：

if (string.IsNullOrEmpty(textBox1.Text) || string.IsNullOrEmpty(textBox2.Text))
{
    MessageBox.Show("No Username and/or Password Found!");
}
else
{
    DataTable dtResult = new DataTable();
    string Command = "select * from southpoint_school.user where userUsername=@un and userPassword=@up";
    using (MySqlConnection myConnection = new MySqlConnection(ConnectionString))
    {

        using (MySqlDataAdapter myDataAdapter = new MySqlDataAdapter(Command, myConnection))
        {
            myDataAdapter.SelectCommand.Parameters.Add(new MySqlParameter("@un", textBox1.Text));
            myDataAdapter.SelectCommand.Parameters.Add(new MySqlParameter("@up", textBox2.Text));
            myDataAdapter.Fill(dtResult);
        }
    }
    if (dtResult.Rows.Count == 1)
    {
        MessageBox.Show("Login successful!", "Success!", MessageBoxButtons.OK, MessageBoxIcon.Information);
        if ((string)dtResult.Rows[0]["userAccountType"] == "Administrator")
        {
            memorable = "Administrator";
            frm_main main = new frm_main();
            main.Show();
            this.Hide();
        }
        else
        {
            memorable = "Limited";
            frm_main main = new frm_main();
            main.Show();
            this.Hide();
        }
    }
    else if (dtResult.Rows.Count == 0)
    {
        MessageBox.Show("Invalid Username And/Or Password!");
    }
    else //TODO: treat the case for multiple results
    {
    }
}