【发布时间】：2014-12-23 11:58:43
【问题描述】：
我希望我的数据库也从我的访问数据库中选择单选按钮。但是，每当我尝试运行我的程序并提供所需的信息时，就会出现一个错误
" 错误：查询表达式 'username=asjjm' 中的字符串语法错误 AND 密码 = 'ksjadklf' AND 教员 = 'False' AND 学生 = '错误的。 "
我真的不明白这样的错误，因为我只是一个初学者。有人可以告诉我有什么问题吗？非常感谢。
Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnLogin.Click
' Check if username or password is empty
If TxtPassword.Text = "" Or TxtUsername.Text = "" Then
MessageBox.Show("Please complete the required fields.", "Authentication Error!", MessageBoxButtons.OK, MessageBoxIcon.Error)
Else
' Both fields was supply
' Check if user exist in database
' Connect to DB
Dim conn As New System.Data.OleDb.OleDbConnection()
conn.ConnectionString = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source=C:\Thesis\Thesis\Database2.accdb"
Try
'conn.Open()
'MsgBox("Susscess")
Dim sql As String = "SELECT * FROM tbl_user WHERE username='" & TxtUsername.Text & "' AND password = '" & TxtPassword.Text & "' AND facultymember = '" & RadioButton1.Checked & "' AND student ='" & RadioButton2.Checked '""
Dim sqlCom As New System.Data.OleDb.OleDbCommand(sql)
'Open Database Connection
sqlCom.Connection = conn
conn.Open()
Dim sqlRead As System.Data.OleDb.OleDbDataReader = sqlCom.ExecuteReader()
If sqlRead.Read() Then
MainStud.Show()
Me.Hide()
Else
' If user enter wrong username and password combination
' Throw an error message
MessageBox.Show("Username, Password, and Account Type do not match!", "Authentication Failure", MessageBoxButtons.OK, MessageBoxIcon.Exclamation)
'Clear all fields
TxtPassword.Text = ""
TxtUsername.Text = ""
'Focus on Username field
TxtUsername.Focus()
conn.Close()
End If
Catch ex As Exception
MessageBox.Show("Error:" & ex.Message)
End Try
End If
End Sub
*编辑 我完全按照@chepe263 所说的做了，但出现了两个新错误。
预期语句结束 'System.Data.Sql' 是命名空间，不能用作表达式。 这些是什么原因造成的？注意* 我制作了单选按钮来指示用户是作为教员还是学生登录帐户。
Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles btnLogin.Click
' Check if username or password is empty
If TxtPassword.Text = "" Or TxtUsername.Text = "" Then
MessageBox.Show("Please complete the required fields.", "Authentication Error!", MessageBoxButtons.OK, MessageBoxIcon.Error)
Else
' Both fields was supply
' Check if user exist in database
' Connect to DB
Dim conn As New System.Data.OleDb.OleDbConnection()
conn.ConnectionString = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source=C:\Thesis\Thesis\Database2.accdb"
Try
'conn.Open()
'MsgBox("Susscess")
Dim facultyMemberName As String
Dim rbdtext As String
If RadioButton1.Checked Then
facultyMemberName = RadioButton1.Text
End If
If RadioButton2.Checked Then
rbdtext = RadioButton2.Text
End If
Dim sql As String = "SELECT * FROM tbl_user WHERE username='" & TxtUsername.Text & "' AND password = '" & TxtPassword.Text & "' AND facultymember = '" & facultyMemberName & "' AND student ='" & rbdtext """
Dim sqlCom As New System.Data.OleDb.OleDbCommand(Sql, conn)
'Open Database Connection
sqlCom.Connection = conn
conn.Open()
Dim sqlRead As System.Data.OleDb.OleDbDataReader = sqlCom.ExecuteReader()
If sqlRead.Read() Then
MainStud.Show()
Me.Hide()
Else
' If user enter wrong username and password combination
' Throw an error message
MessageBox.Show("Username and Password do not match!", "Authentication Failure", MessageBoxButtons.OK, MessageBoxIcon.Exclamation)
'Clear all fields
TxtPassword.Text = ""
TxtUsername.Text = ""
'Focus on Username field
TxtUsername.Focus()
conn.Close()
End If
Catch ex As Exception
MessageBox.Show("Error:" & ex.Message)
End Try
End If
End Sub
编辑* 还没有结束。尝试了所有可能的解决方案，但仍然显示错误。对不起，如果它会变得如此混乱。我只是一个初学者。
【问题讨论】：
-
花点时间了解一下 SQL 注入。
-
SQL 中有多个错误。
Password是保留字，所以需要转义，False可能不需要转义。 SQL 参数修复了许多问题，可以保护您免受 SQL 注入。 -
我更改了我的代码，但仍然出现错误 > 子句中的语法错误。 @Plutonix
-
SELECT * FROM tbl_user (...) VALUES我认为这不是有效的 SQL 语法。也许您的意思是 INSERT INTO？ -
您的新 SQL 文本是 SELECT 和 INSERT 语法的混合体。你可能只需要
SELECT * FROM bl_user WHERE username = @u AND [Password] = @p。只有当不同的 John Smith 具有相同的 PW 时，教师等才有意义。