登录验证用户名和密码怎么写

[臭小子]

登录验证用户名和密码怎么写，写了一块不对哪位能改一下。
if (TextBox1.Text != "" && TextBox2.Text != "")
{
string cmdText = "SELECT UserName FROM OfficeAutoDB";
SqlConnection conn = new SqlConnection(connStr);
conn.Open();
SqlCommand cmd = new SqlCommand(cmdText, conn);
SqlDataReader Rd = cmd.ExecuteReader();
string PName = Rd.ToString();

if (TextBox1.Text == PName)
{
Response.Write("<script> alert('dfsf')</script>");
}
Rd.Close();
conn.Close();
}
else
{
Response.Write("<sciprt>alert('用户名和密码不能为空！')</script>");
}

[windowskof99]

if (TextBox1.Text != "" && TextBox2.Text != "")
{
string cmdText = "SELECT UserName FROM OfficeAutoDB WHERE UserID = '"+TextBox1.Text.Trim()+"' AND Password = '"+TextBox2.Text .Trim()+"'";
SqlConnection conn = new SqlConnection(connStr);
conn.Open();
SqlCommand cmd = new SqlCommand(cmdText, conn);
SqlDataReader Rd = cmd.ExecuteReader();
if(Rd.Read()){
string PName = Rd.GetString("username字段列号"//从0开始).ToString();
Response.Write("<script> alert('dfsf')</script>");
Rd.Close();
conn.Close();
}
else
{
Response.Write("<sciprt>alert('用户名和密码不能为空！')</script>");
}

[wkcode]

为什么不用验证控件呢???还可以正则表达试写规则

[NekChan]

SELECT UserName FROM OfficeAutoDB WHERE UserID = '' AND Password = ''

这样很容易被人家注入攻击, 使用参数吧

[NekChan]

你这样返回的 DataReader 也应该 Read() 啊!

多看看 ADO.NET 的書

[W清风大侠M]

if (TextBox1.Text != "" && TextBox2.Text != "")
{
string cmdText = "SELECT UserName FROM OfficeAutoDB WHERE UserID = '"+TextBox1.Text.Trim()+"' AND Password = '"+TextBox2.Text .Trim()+"'";
SqlConnection conn = new SqlConnection(connStr);
conn.Open();
SqlCommand cmd = new SqlCommand(cmdText, conn);
SqlDataReader Rd = cmd.ExecuteReader();
if(Rd.Read()){
string PName = Rd.GetValue(0).ToString();
Response.Write("<script> alert('dfsf')</script>");
Rd.Close();
conn.Close();
}
else
{
Response.Write("<sciprt>alert('用户名和密码不能为空！')</script>");
}

[cqdyh]

查询 SQL 参数设置

string sqlLogin = "SELECT * FROM [User] WHERE ([flag]=1) AND ([LoginName]=@LoginName)";
System.Data.SqlClient.SqlCommand sqlCmdObj = new System.Data.SqlClient.SqlCommand(sqlLogin);
sqlCmdObj.Parameters.Add("@LoginName", System.Data.SqlDbType.NVarChar, 64).Value=loginName;

其它的上面都说得很清楚了.

[qufo]

同意楼上.

放着好的不用.

[jxf654]

up