Question

请问C#中条件查询时where中的一个值由textbox的text值来决定，重点请问select语句怎么写？部分代码如下：

顺便帮我看下这段代码(部分)有没不合理的地方：

//核对用户名、密码、身份

SqlCommand cmd = conn.CreateCommand();
cmd.CommandText = "SELECT UserName, Password, Status FROM Users WHERE UserName = '+this.UserName .Text +' ";
reader = cmd.ExecuteReader();
string username = "";
string password = "";
string status= "";
while (reader.Read())
{
username = reader.GetValue(0).ToString();
password = reader.GetValue(1).ToString();
status =reader .GetValue (2).ToString ();
}

if (this.UserName .Text ==username &&this.PassWord .Text ==password &&this.Status .Text ==status )
{
Manager manager = new Manager(this.UserName);
try
{
manager.ShowDialog(this);
}
finally
{
manager.Dispose();
}
Close();
}
else
{
MessageBox.Show("用户名不存在或密码错误！","提示");
}

Answer 1

cmd.CommandText = "SELECT UserName, Password, Status FROM Users WHERE UserName = '+this.UserName .Text +' ";

改成

string strSql = "SELECT UserName, Password, Status FROM Users WHERE UserName = '"+this.UserName .Text +"' ";
cmd.CommandText = strSql;

Answer 2

Select 语句加一个TOP 1吧，符合要求的记录应该只有一条。
只有一条语句怎么还使用While来读取？

Answer 3

你不是已经写好了吗？虽然这样直接拼接是有SQL注入的安全问题的。

Answer 4

不知道你的com 对象的连接在哪儿?