查詢用戶表時「登錄」不成功

Question

這是我的代碼。我正在嘗試創建一個登錄頁面。代碼的問題在於'count'值不會增加。 是的，我的表中有足夠的數據。 每次它轉到else條件的一部分，說明無效的登錄憑證。 我的連接建立發生在不同的類，所以在這裏我只是調用對象。 這到底是什麼地方出了問題？ 請幫忙！

using System; 
using System.Collections.Generic; 
using System.ComponentModel; 
using System.Data; 
using System.Drawing; 
using System.Linq; 
using System.Text; 
using System.Threading.Tasks; 
using System.Windows.Forms; 
using MySql.Data.MySqlClient; 

namespace WindowsFormsApplication1 
{ 
public partial class login : Form 
{ 
    public login() 
    { 
     InitializeComponent(); 
    } 

    public void login_Load(object sender, EventArgs e) 
    { 

     //to show tip on mouseover on text fields 
     System.Windows.Forms.ToolTip ToolTip1 = new System.Windows.Forms.ToolTip(); 
     ToolTip1.SetToolTip(this.username_combobox, "username cannot be more that 20 characters   long"); 
     ToolTip1.SetToolTip(this.password_txt, "Not more than 10 characters"); 

     //mysql connection 
     Connection con = new Connection(); 
     MySqlConnection conn = con.GetConnection(); 

     //filling the combo box with data from project.userdetails.username 
     string query = "select username from project.user_details;"; 
     MySqlDataAdapter da = new MySqlDataAdapter(query, conn); 
     DataTable dt = new DataTable(); 
     da.Fill(dt); 
     username_combobox.DataSource = dt; 
     username_combobox.DisplayMember = "username"; 
     conn.Close(); 
    } 

    private void forgotpassword_label_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e) 
    { 
     forgot_password fp = new forgot_password(); 
     fp.Show(); 
    } 

    private void newuser_linklable_LinkClicked(object sender, LinkLabelLinkClickedEventArgs e) 
    { 
     newuser nu = new newuser(); 
     nu.Show(); 

    } 

    private void submit_btn_Click(object sender, EventArgs e) 
    { 
     try 
     { 
      Connection con = new Connection(); 
      MySqlConnection conn = con.GetConnection(); 
      MySqlCommand selectCommand = new MySqlCommand("select * from project.user_details  where username =' " + this.username_combobox.Text + " ' and password = ' " + this.password_txt.Text + " '; ", conn); 


      MySqlDataReader myreader; 

      myreader = selectCommand.ExecuteReader(); 
      int counter = 1; 

      while (myreader.Read()) 
      { 
       counter = counter + 1; 
      } 
      if (counter == 2) 
      { 
       MessageBox.Show("Login successfull"); 
       Dashboard_form db = new Dashboard_form(); 
       db.Show(); //open dashboard 
       Hide(); 
      } 
      else if (counter > 1) 
      { 
       MessageBox.Show("Access denied. more than 1 account present"); 
      } 
      else 
      { 
       MessageBox.Show("Invalid login credentials"); 
      } 
      conn.Close(); 
     } 
     catch(Exception x) 
     { MessageBox.Show(x.Message); } 
    } 

    private void username_combobox_SelectedIndexChanged(object sender, EventArgs e) 
    { 

    } 

    private void toolStrip1_ItemClicked(object sender, ToolStripItemClickedEventArgs e) 
    { 


    } 
} 
} 

Answer 1

一個問題是，選擇語句正試圖以匹配空間包圍的用戶名，如' Jimbox '或' Susanblinkz '。儘管可以簡單地刪除額外的空白區域，但請花些時間到修復破碎的SQL（和潛在注入）並使用佔位符，這也會使問題更加明顯。

MySqlCommand selectCommand = new MySqlCommand(
    @"select * from project.user_details 
     where username=@username and password=@password", 
    conn); 

selectCommand.Parameters 
      .Add("@username", SqlDbType.NVarChar) 
      .Value = username_combobox.Text; 
selectCommand.Parameters 
      .Add("@password", SqlDbType.NVarChar) 
      .Value = password_txt.Text; 

聲明：我不使用MySqlCommand，所以上面可能需要對SQL文本或參數進行一些修改。

當然，存儲純文本密碼的整個方法是hogwash，但是......已經很晚了，我要睡覺了。

Answer 2

更換線路，

MySqlCommand selectCommand = new MySqlCommand("select * from project.user_details  where username =' " + this.username_combobox.Text + " ' and password = ' " + this.password_txt.Text + " '; ", conn); 

通過，

var strQuery = "select * from project.user_details where username ='" + this.username_combobox.Text + "' and password = '" + this.password_txt.Text + "'; "; 
MySqlCommand selectCommand = new MySqlCommand(strQuery, conn); 

你應該使調試代碼的習慣。 看看strQuery在那個時候返回什麼，並嘗試在sqlserver中執行查詢。 我們可以簡單地跟蹤問題。