Question

必须声明标量变量 "@oldpass"的错误

protected void Button_Save_Click(object sender, EventArgs e)
{
String username = this.TextBox_LoginName.Text.Trim();
String oldpass = this.TextBox_OldPass.Text.Trim();
String newpass = this.TextBox_NewPass.Text.Trim();
String conpass = this.TextBox_Confirm.Text.Trim();

if (username.Length == 0)
{
this.Label2.Text = "请输入用户名！";
this.TextBox_LoginName.Focus();
return;
}
if (newpass != conpass)
{
this.Label2.Text = "两次输入密码不匹配！";
this.TextBox_NewPass.Focus();
return;
}

SqlConnection conn = new SqlConnection(@"server=.\SQLEXPRESS;AttachDbFilename=|DataDirectory|\yonghu.mdf;Integrated Security=True;Connect Timeout=30;User Instance=True");

SqlCommand cmd;
SqlDataReader dr;

string t_sql = "select 管理员,密码 from yonghu where 管理员=@username and 密码=@oldpass";

cmd = new SqlCommand(t_sql, conn);
try
{
conn.Open();
SqlParameter pu = new SqlParameter("@username", SqlDbType.VarChar, 200);

SqlParameter ppassword = new SqlParameter("@newpass", SqlDbType.VarChar, 200);

cmd.Parameters.Add(pu);
cmd.Parameters.Add(ppassword);
dr = cmd.ExecuteReader();
dr.Read();
if (dr.HasRows)
{
dr.Close();
t_sql = "update yonghu set 密码=@passw where 管理员=@userid";
SqlCommand cmdre = new SqlCommand(t_sql, conn);
SqlParameter ppa = new SqlParameter("@passw", SqlDbType.VarChar, 200);
ppa.Value = this.TextBox_NewPass.Text.Trim();

cmdre.Parameters.Add(ppa);
cmdre.Parameters.Add(pu);
int t = cmdre.ExecuteNonQuery();
if (t > 0)
{
this.Label2.Text = "修改密码成功！";
}
else { this.Label2.Text = "修改失败！"; }
}

conn.Dispose();
conn.Close();
}

finally { }
}

Answer 1

很明显的错误
string t_sql = "select 管理员,密码 from yonghu where 管理员=@username and 密码=@oldpass";

cmd = new SqlCommand(t_sql, conn);
try
{
conn.Open();
SqlParameter pu = new SqlParameter("@username", SqlDbType.VarChar, 200);

SqlParameter ppassword = new SqlParameter("@newpass", SqlDbType.VarChar, 200);

cmd.Parameters.Add(pu);
cmd.Parameters.Add(ppassword);
dr = cmd.ExecuteReader();
dr.Read();

你的sql语句里面写的参数是 密码=@oldpass";
你这里new的是@newpass ，没提供@oldpass
SqlParameter ppassword = new SqlParameter("@newpass", SqlDbType.VarChar, 200);

Answer 2

因为你所用到的变量名@oldpass和你声明的变量名@newpass不一致，所以程序不认识@oldpass变量。你只要给把下面声明的变量名@newpass改成@oldpass就可以了，还有下面也是同样的错误@userid变量名和上面你声明的@username变量名是不一样的，所以你不能在下面的语句也添加cmdre.Parameters.Add(pu);而是需要再声明一个变量变量名要写@userid这个然后再添加进去。就可以了。

Answer 3

string t_sql = "select 管理员,密码 from yonghu where 管理员=@username and 密码=@oldpass";

cmd = new SqlCommand(t_sql, conn);
try
{
conn.Open();
SqlParameter pu = new SqlParameter("@username", SqlDbType.VarChar, 200);

SqlParameter ppassword = new SqlParameter("@newpass", SqlDbType.VarChar, 200);

把 @OLDPASS 该为 @newpass
或把 @newpass该为@OLDPASS

Answer 4

参数化查询 '(@username varchar(200),@oldpass varchar(200))select 管理员,密码 f' 需要参数 @username，但未提供该参数。这是什么错啊