Question

关于c#用户登录的问题 不知道错在哪儿了 在线求解 不胜感激啊

private void button1_Click(object sender, EventArgs e)
{
if (textBox1.Text ==""||textBox2 .Text =="")
{
MessageBox.Show("还有项没有填写！");
}
else
{
string _name = textBox1.Text.ToString ().Trim ();
string _password = textBox2.Text.ToString() .Trim();
string mysql="select * from UserInfo where name="+_name+"and password="+_password+"";
string myconn = ConfigurationManager.ConnectionStrings["PersonnelManagementSyetem.Properties.Settings.userdatabaseConnectionString"].ConnectionString;
SqlConnection myconnection = new SqlConnection(myconn);
myconnection.Open();
SqlCommand mycommand = new SqlCommand(mysql ,myconnection );
int count = Convert.ToInt32(mycommand.ExecuteScalar());
if (count > 0)
{
MainForm mainform = new MainForm();
mainform.Show();
}
else
{
MessageBox.Show("用户名或者密码错误，请重新输入！");
}
}
}

Answer 1

string mysql="select * from UserInfo where name="+_name+"and password="+_password+"";
这个语句本身就有问题，要改成
string mysql="select * from UserInfo where name='"+_name+"' and password='"+_password+"'";