c# - C#从数据库中获取值

Question

大家下午好!

所以，我试图从我的数据库中获取一个值，这是我的示例代码:

MySqlCommand cmd = new MySqlCommand("Select * from tbluser where userName ='" + txtUser.Text + "' and userPass ='" + txtPass.Text + "'", con);

                con.Open();
                reader = cmd.ExecuteReader();
                int count = 0;

                while (reader.Read())
                {
                    count = count + 1;
                }

                if (count == 1)
                {


                        if (reader.HasRows) 
                        {
                            while (reader.Read()) 
                            {
                                lblID.Text = reader(0);
                            }
                         }



                    MessageBox.Show("You have successfully logged in!");

                    homeMain homeMain = new homeMain();

                    homeMain.Passvalue = txtUser.Text;
                    homeMain.Passvalue = lblID.Text;
                    homeMain.Show();
                    this.Hide();



                }

代码试图实现的是，当我按下 LOG-IN 时，它搜索与 txtUser 相同的数据库，然后在 lbl.Text 上显示 id。我在 reader(0) 下有波浪线。似乎是什么问题？

Answer 1

您的代码存在一些问题。

首先，您应该使用参数化命令来避免可能的 SQL 注入(inject)攻击。其次，您将 reader 向前移动两次，因此第二个 reader.Read() 不会返回任何行，假设您的查询结果返回了 1 行(因为它应该有当我们登录用户时)。

MySqlCommand cmd = new MySqlCommand("Select Id from tblUser where userName = @username and userPass = @pass", con);
cmd.Parameters.AddWithValue("@username", txtUser.Text);
cmd.Parameters.AddWithValue("@pass", txtPass.Text);

con.Open();

//Executes the query, and returns the first column of the first row in the result set returned by the query. Extra columns or rows are ignored.
object value = cmd.ExecuteScalar();

if (value == null)
{
   //login failed
}
else
{
   MessageBox.Show("You have successfully logged in!");

  homeMain homeMain = new homeMain();

  homeMain.Passvalue = txtUser.Text;
  homeMain.Passvalue = value.ToString();
  homeMain.Show();
  this.Hide();
}