檢查MySQL數據庫的用戶名和密碼C＃

Question

一直有問題，這幾天的。我正在使用簡單的用戶名和密碼登錄屏幕，並將所有內容都存儲在數據庫中。幾乎我需要檢查，看看用戶名和密碼是否匹配，並看看是否有帳戶激活（0或1）。我一直有這個問題，似乎無法讓它正常工作。任何幫助表示讚賞。

DB Mysql的

private void loginButton_Click(object sender, EventArgs e) 
     { 
      AdamPanel blarg = new AdminPanel(); 
      string pass, user; 
      string password = ""; 
      string username = ""; 

      user = usernameBox.Text; 
      pass = passwordBox.Text;   
      DataSet bb = new DataSet(); 

      string connectionString = "datasource=stuff;database=users"; 
      MySqlConnection mysql = new MySqlConnection(connectionString); 
      MySqlDataAdapter adapter = new MySqlDataAdapter(); 

      adapter.SelectCommand = new MySqlCommand("SELECT * FROM RegularUsers WHERE Username = '" + user + "' AND Password = '" + pass + "'", mysql); 
      adapter.Fill(bb); 

      if(bb.HasRows) 
       blarg.Show(); 
      return 0; 





     } 

    } 
} 

仍然沒有工作任何想法？

Answer 1

public bool ValidateLogin(string username, string password) 
    { 

    MySqlConnection conn = new MySqlConnection("[YOURCONNECTIONSTRING]"); 
    MySqlDataAdapter adapter = new MySqlDataAdapter(); 
    adapter.SelectCommand = new MySqlCommand("SELECT * FROM [YOURUSERTABLE] WHERE Username = ? AND Pass = ?", conn); 

    adapter.SelectCommand.Parameters.Add("@Username", username); 
    adapter.SelectCommand.Parameters.Add("@Password", password); 

    adapter.Fill(dataset); 


    If (dataset.HasRows) 
    { 
     // User is logged in maybe do FormsAuthentication.SetAuthcookie(username); 
     return true; 
    } else { 
     // Authentication failed 
     return false; 
    } 

    } 

Answer 2

首先請散列並填寫您的密碼。因爲你沒有使用與參數化查詢語言... prolly最好使用存儲的特效，因爲我相信MySQL有他們現在請確保您的用戶名/密碼arn't SQL注入漏洞。

然而，儘管這個...我認爲這是你在找什麼。

public int Load() 
    { 
     string connectionString = "datasource=STUFF YOU SHOULDNT SEEdatabase=users"; 
     MySqlConnection mysql = new MySqlConnection(connectionString); 
     MySqlDataAdapter adapter = new MySqlDataAdapter(); 

     mysql.SelectCommand = new MySqlCommand("SELECT * FROM [RegularUsers] WHERE Username = '" + this.username + "' AND Pass = '" + this.password + "'", conn); 
     mysql.Fill(dataset); 


     if (dataset.HasRows) 
      return 1; 
     return 0; 
    } 

Answer 3

首先，您必須包含使用MySql.Data.MySqlClient。
使用這些功能：

public MySqlConnection NewConnection() 
{ 
    string cstr = String.Format(
     "SERVER={0};PORT={1};DATABASE={2};UID={3};PWD={4}", 
     sett.DBHost, sett.DBPort, sett.DBDatabase, 
     HotelDB.user, HotelDB.password); 
    MySqlConnection conn = new MySqlConnection(cstr); 
    try { conn.Open(); } 
    catch (Exception ex) 
    { 
     conn = null; 
    } 
    return conn; 
} 


private MySqlCommand NewCommand(MySqlConnection conn, string cmd, params object[] parameters) 
{ 
    if (conn==null) return null; 
    MySqlCommand command; 
    try 
    { 
     command = new MySqlCommand(cmd, conn); 
     if (parameters != null) 
     { 
      int index = 0; 
      while (index < parameters.Length) 
      { 
       command.Parameters.Add(
        new MySqlParameter((string)parameters[index], parameters[index + 1])); 
       index += 2; 
      } 
     } 
    } 
    catch { command = null; } 
    return command; 
} 

private string MD5(string Value) 
{ 
     System.Security.Cryptography.MD5CryptoServiceProvider x = new System.Security.Cryptography.MD5CryptoServiceProvider(); 
     byte[] data = System.Text.Encoding.ASCII.GetBytes(Value); 
     data = x.ComputeHash(data); 
     string ret = ""; 
     for (int i=0; i < data.Length; i++) 
       ret += data[i].ToString("x2").ToLower(); 
     return ret; 
} 

然後，你可以這樣做：

MySqlConnection conn = NewConnection(.....); 
MySqlCommand cmd = NewCommand(conn,"SELECT userid,useractive FROM table WHERE username=@user AND MD5(password)=@pwd","user",username,"pwd",MD5(pwd)); 
MySqlDataReader rd = cmd.ExecuteReader(); 

其中，username和pwd是從用戶鍵入的人。 如果rd爲空user/pwd是錯誤的;否則你可以閱讀你需要的字段。

Answer 4

我改變了一些變數，使之儘可能簡單， 代替聲明爲文本框的變量，我直接到適配器：

private void button Click 
{ 
    MySqlConnection mcon = new MySqlConnection("Yourconnection"); 
    MySqlDataAdapter adapter; 
    DataTable table = new DataTable(); 

    adapter = new MySqlDataAdapter("Select * From database.table where Username = '" + textbox1.Text + "' and password = '" + textbox2.Text + "'", mcon); 
    adapter.Fill(table); 
    if (table.Rows.Count <= 0) 
    { 
     //message something 
    } 
    else 
    { 
     //show main form 
    } 
}