如何从 mysql 数据库中检索数据

Question

此代码来自我们 SAD 项目的用户登录配置文件。我注册的用户登录帐户保存在数据库中，但我无法登录，因为它显示无效。

private void btn_login_Click(object sender, EventArgs e)
        {
            conn = new MySqlConnection(myconn);
            string query = "select * from southpoint_school.user where userUsername='" + textBox1.Text + "' and userPassword='" + textBox2.Text + "'";
            conn.Open();
           cmd = new MySqlCommand(query, conn);

       MySqlDataReader reader = cmd.ExecuteReader();
        int count = 0;

        while (reader.Read())
        {
            count++;
        }

        if (count == 1)
        {
            conn = new  MySqlConnection(myconn);

            string problem = "SELECT userAccountType from southpoint_school.user WHERE userUsername ='" + textBox1.Text + "'";
            conn.Open();
            cmd = new MySqlCommand(problem, conn);
            string answer = cmd.ExecuteScalar().ToString();
            conn.Close();

            MessageBox.Show("Login successful!", "Success!", MessageBoxButtons.OK, MessageBoxIcon.Information);

            if (answer == "Administrator")
            {
                memorable = "Administrator";

                frm_main main = new frm_main();
                main.Show();
                this.Hide();
            }
            else
            {
                memorable = "Limited";

                frm_main main = new frm_main();
                main.Show();
                this.Hide();
            }
        }
        else if (textBox1.Text == "" && textBox2.Text == "")
        {
            MessageBox.Show("No Username and/or Password Found!");
        }
        else
        {
            MessageBox.Show("Invalid Username And/Or Password!");
        }
        conn.Close();
    }

Answer 1

案例

用户名和/或密码无效！

只有当您在southpoint_school.user 数据库中使用您输入的用户名 + 密码有 0 个或超过 1 个搜索结果时才会发生。所以我会检查你数据库中的数据。

另外我会

• 使用参数而不是字符串连接来创建sql语句以避免注入
• 在您的数据库中保存（加盐）散列密码而不是纯文本
• 使用 using 语句更有效地使用资源
• 只查询一次用户表并使用两次结果

例如：

if (string.IsNullOrEmpty(textBox1.Text) || string.IsNullOrEmpty(textBox2.Text))
{
    MessageBox.Show("No Username and/or Password Found!");
}
else
{
    DataTable dtResult = new DataTable();
    string Command = "select * from southpoint_school.user where userUsername=@un and userPassword=@up";
    using (MySqlConnection myConnection = new MySqlConnection(ConnectionString))
    {

        using (MySqlDataAdapter myDataAdapter = new MySqlDataAdapter(Command, myConnection))
        {
            myDataAdapter.SelectCommand.Parameters.Add(new MySqlParameter("@un", textBox1.Text));
            myDataAdapter.SelectCommand.Parameters.Add(new MySqlParameter("@up", textBox2.Text));
            myDataAdapter.Fill(dtResult);
        }
    }
    if (dtResult.Rows.Count == 1)
    {
        MessageBox.Show("Login successful!", "Success!", MessageBoxButtons.OK, MessageBoxIcon.Information);
        if ((string)dtResult.Rows[0]["userAccountType"] == "Administrator")
        {
            memorable = "Administrator";
            frm_main main = new frm_main();
            main.Show();
            this.Hide();
        }
        else
        {
            memorable = "Limited";
            frm_main main = new frm_main();
            main.Show();
            this.Hide();
        }
    }
    else if (dtResult.Rows.Count == 0)
    {
        MessageBox.Show("Invalid Username And/Or Password!");
    }
    else //TODO: treat the case for multiple results
    {
    }
}