c# - 在一个文本框中进行多次搜索 my sql c#

Question

        private void searchButton_Click(object sender, EventArgs e)
    {
        string constring = "datasource=localhost;port=3306;Initial Catalog = 'dbcpu'; username = root; password =";
        string query = "select * from admin where UserID='" + maskedTextBox1.Text + "'";

        MySqlConnection conDataBase = new MySqlConnection(constring);
        MySqlCommand cmdDataBase = new MySqlCommand(query, conDataBase);
        MySqlDataReader myReader;

        try
        {
            conDataBase.Open();
            myReader = cmdDataBase.ExecuteReader();

            while (myReader.Read())
            {
                string Idnum = myReader.GetString(myReader.GetOrdinal("UserID"));
                label1.Text = Idnum;

                string Lname = myReader.GetString(myReader.GetOrdinal("UserLname"));
                Lname1.Text = Lname;

                string Fname = myReader.GetString(myReader.GetOrdinal("UserFname"));
                Fname1.Text = Fname;

                string Mname = myReader.GetString(myReader.GetOrdinal("UserMname"));
                Mname1.Text = Mname;

                string Gender = myReader.GetString(myReader.GetOrdinal("UserGender"));
                Gend1.Text = Gender;

                string Pos = myReader.GetString(myReader.GetOrdinal("Administrative"));
                Pos1.Text = Pos;

                string Dept = myReader.GetString(myReader.GetOrdinal("UserDepartment"));
                Off1.Text = Dept;

                byte[] imgg = (byte[])(myReader["IDPicture"]);
                if (imgg == null)
                    pictureBox1.Image = null;
                else
                {
                    MemoryStream mstream = new MemoryStream(imgg);
                    pictureBox1.Image = Image.FromStream(mstream);
                }
            }
            conDataBase.Close();
        }
        catch (Exception ex)
        {
            MessageBox.Show(ex.Message);
        }
    }

我只能搜索身份证号码。我还想在同一个框中搜索姓氏或名字，它会给我结果。我认为它在查询中的某个地方。提前致谢。 :D

Answer 1

您可以使用 int.TryParse 来验证输入为整数 ID，否则，将其用作名字/姓氏值，我已修改您的代码以包含命令参数以避免注入(inject)。

private void searchButton_Click(object sender, EventArgs e)
{
    string constring = "datasource=localhost;port=3306;Initial Catalog = 'dbcpu'; username = root; password =";

    string whereCondition = "WHERE UserFname = @SearchInput OR  UserLname = @SearchInput";
    int searchId = 0;
    if(int.TryParse(maskedTextBox1.Text, out searchId))
      whereCondition = "WHERE UserID = @SearchInput";


    string query = "select * from admin " + whereCondition;

    MySqlConnection conDataBase = new MySqlConnection(constring);
    MySqlCommand cmdDataBase = new MySqlCommand(query, conDataBase);                    
    cmdDataBase.Parameters.AddWithValue("@SearchInput", maskedTextBox1.Text);    


    MySqlDataReader myReader;

    try
    {
        conDataBase.Open();
        myReader = cmdDataBase.ExecuteReader();

        while (myReader.Read())
        {
            string Idnum = myReader.GetString(myReader.GetOrdinal("UserID"));
            label1.Text = Idnum;

            string Lname = myReader.GetString(myReader.GetOrdinal("UserLname"));
            Lname1.Text = Lname;

            string Fname = myReader.GetString(myReader.GetOrdinal("UserFname"));
            Fname1.Text = Fname;

            string Mname = myReader.GetString(myReader.GetOrdinal("UserMname"));
            Mname1.Text = Mname;

            string Gender = myReader.GetString(myReader.GetOrdinal("UserGender"));
            Gend1.Text = Gender;

            string Pos = myReader.GetString(myReader.GetOrdinal("Administrative"));
            Pos1.Text = Pos;

            string Dept = myReader.GetString(myReader.GetOrdinal("UserDepartment"));
            Off1.Text = Dept;

            byte[] imgg = (byte[])(myReader["IDPicture"]);
            if (imgg == null)
                pictureBox1.Image = null;
            else
            {
                MemoryStream mstream = new MemoryStream(imgg);
                pictureBox1.Image = Image.FromStream(mstream);
            }
        }
        conDataBase.Close();
    }
    catch (Exception ex)
    {
        MessageBox.Show(ex.Message);
    }
}