“不正确的用户名和密码”虽然正确？

Question

我有一个 MS Access 2016 数据库，用户使用用户名和密码登录数据库。然后代码会打开一组表单，但是有一个我找不到的错误。

Private Sub btnLogin_Click()
If IsNull(Me.txtBoxUsername) Then
    MsgBox "Please Enter Username", vbInformation, "Username Required"
    Me.txtBoxUsername.SetFocus
ElseIf IsNull(Me.txtBoxPassword) Then
    MsgBox "Please Enter Password", vbInformation, "Password Required"
    Me.txtBoxPassword.SetFocus
Else
    'proccess the job
    If ((IsNull(DLookup("Username", "Staff Table", "Username='& Me.txtBoxUsername.Value &'"))) Or _
    (IsNull(DLookup("Password", "Staff Table", "Password='& Me.txtBoxPassword.Value &'")))) Then
        MsgBox "Incorrect Username Or Password"
    Else
        MsgBox "Username & Password Correct"
        DoCmd.OpenForm "Branch Form"
        DoCmd.OpenForm "Customer Form"
        DoCmd.OpenForm "Item Form"
        DoCmd.OpenForm "Order Form"
        DoCmd.OpenForm "Staff Form"
    End If
End If
End Sub

员工的用户名和密码是“RJ1”。当我尝试使用这些凭据登录时，会出现 MsgBox "Incorrect Username Or Password"。

为什么会这样？

*作为对 HansUp 问题“错误信息是什么？”的回答

解决方案：

Private Sub btnLogin_Click()

Dim db As DAO.Database
Dim qdf As DAO.QueryDef
Dim strSelect As String
strSelect = "SELECT Count(*) FROM [Staff Table]" & vbCrLf & _
    "WHERE Username=[pUser] AND [Password]=[pPWD];"
Set db = CurrentDb
Set qdf = db.CreateQueryDef(vbNullString, strSelect)
qdf.Parameters("pUser").Value = Me!txtBoxUsername.Value
qdf.Parameters("pPWD").Value = Me!txtBoxPassword.Value
If qdf.OpenRecordset(dbOpenSnapshot)(0) = 0 Then

End If

If IsNull(Me.txtBoxUsername) Then

    MsgBox "Please Enter Username", vbInformation, "Username Required"
    Me.txtBoxUsername.SetFocus

ElseIf IsNull(Me.txtBoxPassword) Then

    MsgBox "Please Enter Password", vbInformation, "Password Required"
    Me.txtBoxPassword.SetFocus

Else
    'proccess the job
    If ((IsNull(DLookup("[Username]", "Staff Table", "[Username] = '" & Me.txtBoxUsername.Value & "'"))) Or _
(IsNull(DLookup("[Password]", "Staff Table", "[Password] = '" & Me.txtBoxPassword.Value & "'")))) Then
        MsgBox "Incorrect Username Or Password"
    Else
        DoCmd.OpenForm "Branch Form"
        DoCmd.OpenForm "Customer Form"
        DoCmd.OpenForm "Item Form"
        DoCmd.OpenForm "Order Form"
        DoCmd.OpenForm "Staff Form"
    End If

End If
End Sub

Answer 1

作为Christopher pointed out，此If 表达式评估用户名和密码是否在Staff Table 中找到，但不一定在同一行中找到。因此，如果您提交一个用户的名称和另一个用户的密码，此逻辑会将这些值视为有效组合：

'proccess the job
If ((IsNull(DLookup("Username", "Staff Table", "Username='" & Me.txtBoxUsername.Value & "'"))) Or _
    (IsNull(DLookup("[Password]", "Staff Table", "[Password]='" & Me.txtBoxPassword.Value & "'")))) Then
    ' Note: quotes added .....................................^.............................^

确保检查用户名和密码是否存在于同一行：

Dim strCriteria As String
strCriteria  = "Username='" & Me.txtBoxUsername.Value & "' AND [Password]='" & Me.txtBoxPassword.Value & "'"
Debug.Print strCriteria '<- inspect in Immediate window; Ctrl+g will take you there
If DCount("*", "Staff Table", strCriteria) = 0 Then
    MsgBox "Incorrect Username Or Password"
End If

虽然该更改在逻辑上可能是正确的，但当用户名或密码包含撇号时，它可能会中断。一个不那么脆弱的方法是基于参数查询的Recordset：

Dim db As DAO.Database
Dim qdf As DAO.QueryDef
Dim strSelect As String
strSelect = "SELECT Count(*) FROM [Staff Table]" & vbCrLf & _
    "WHERE Username=[pUser] AND [Password]=[pPWD];"
Set db = CurrentDb
Set qdf = db.CreateQueryDef(vbNullString, strSelect)
qdf.Parameters("pUser").Value = Me!txtBoxUsername.Value
qdf.Parameters("pPWD").Value = Me!txtBoxPassword.Value
If qdf.OpenRecordset(dbOpenSnapshot)(0) = 0 Then
    MsgBox "Incorrect Username Or Password"
End If

Answer 2

我认为您的 DLookups 因语法错误而失败。试试：

If ((IsNull(DLookup("[Username]", "Staff Table", "[Username] = '" & Me.txtBoxUsername.Value & "'"))) Or _
(IsNull(DLookup("[Password]", "Staff Table", "[Password] = '" & Me.txtBoxPassword.Value & "'")))) Then