C# 獲取 sql 表列值並將其放入變量中

Question

我有一個用戶登錄菜單。 我想根據用戶的級別重定向用戶。 級別數據在 SQL 表中。 我想根據他們的用戶名從表中獲取級別數據並將其分配給一個變量。

protected void btnDefault_Click(object sender, EventArgs e)
{
//filter entered text
string strUserName = Tools.checkSQLInjection(txtUserName.Text).Trim();
string strPassword = Tools.checkSQLInjection(txtPassword.Text);
string strError = "";

//Get Dealer Level Value
SqlCommand command = new SqlCommand("SELECT dealerLvl FROM Users where email='" + strUserName + "'");
string strDealerLvl = "dealerLvl".ToString();
int intDealerLvl;
bool isParsable = Int32.TryParse(strDealerLvl, out intDealerLvl);

if (strDealerLvl == "1")
  {  Response.Redirect("/dealers/dashboard"); }
else if (strDealerLvl == "2")
  {  Response.Redirect("/dealers/dashboard-2"); }

Answer 1

            using(SqlCommand command = new SqlCommand("SELECT dealerLvl FROM Users where email= @strUserName", connection))
            {
                command.CommandType = CommandType.Text;
                command.Parameters.AddWithValue("@strUserName", strUserName);
                DataSet ds = new DataSet();
                using(SqlDataAdapter da = new SqlDataAdapter(command))
                    da.Fill(ds);
        
                //Get the result of the first row        
                DataRow dr = ds.Tables[0].Rows[0];
        
               //Get the value of the column in the first row        
               string strDealerLvl = dr["dealerLvl"].ToString();    
            }

Answer 2

您似乎沒有檢查密碼，但也許應該稍后再檢查。

執行此操作的工作代碼存根看起來像這樣說：

DataTable MyTable = new DataTable();
int intDealerLvl = 0;

using (SqlCommand cmdSQL = new SqlCommand("SELECT dealerLv1 FROM Users where email = @meail", 
          new SqlConnection(My.Settings.test3ConnectionString)))
{
    cmdSQL.Parameters.Add("@email", SqlDbType.NVarChar).Value = strUserName;
    cmdSQL.Connection.Open();
    MyTable.Load(cmdSQL.ExecuteReader);
}

if (MyTable.Rows.Count > 0)
    intDealerLvl = MyTable.Rows(0)(0);

switch (intDealerLvl)
{
    case 1:
        {
            Response.Redirect("/dealers/dashboard");
            break;
        }

    case 2:
        {
            Response.Redirect("/dealers/dashboard-2"); 
            break;
        }

    default:
        {
            // no level found - where to go??
            break;
        }
}

但是，不清楚您是否應該檢查密碼，如果是這樣，那么我們當然會使用它：

DataTable MyTable = new DataTable();
string strSQL;
strSQL = "SELECT dealerLv1 FROM Users where email = @Email and Password = @Pass";

using (SqlCommand cmdSQL = new SqlCommand(strSQL, 
          new SqlConnection(My.Settings.test3ConnectionString)))
{
cmdSQL.Parameters.Add("@email", SqlDbType.NVarChar).Value = strUserName;
cmdSQL.Parameters.Add("@Pass", SqlDbType.NVarChar).Value = strPassword;
cmdSQL.Connection.Open();
MyTable.Load(cmdSQL.ExecuteReader);

if (MyTable.Rows.Count > 0)
    intDealerLvl = MyTable.Rows(0)(0);