以下是我用mysql做的参数化查询，好像不正确，帮忙更正一下！！！

Question

 {
        if (TB_NewPassword.Text != TB_NewPassword2.Text)
        {
            Lbl_Hite.Text = "新密码和确认密码不一致！";
            return;
        }
        if (TB_NewPassword.Text == "")
        {
            Lbl_Hite.Text = "密码不能为空！";
            return;
        }
        MySqlCommand cmd=new MySqlCommand();        MySqlParameter[] parm = new MySqlParameter[]
            {
                new MySqlParameter("?User_Name", DbType.String),
                new MySqlParameter("?Password", DbType.String)
            };
        parm[0].Value = TB_UserName.Text;
        parm[1].Value = TB_NewPassword2.Text;
      
       
      
        try
        {
            int s = bbsfunction.CalculateURecord(TB_UserName.Text, TB_Password.Text);
            if (s > 0)
            {                DbHelperSQL.ExecuteSql("UPDATE Users SET Password ='" + "?User_Name" + "' WHERE (User_Name ='" + "?Password" + "')");
                Lbl_Hite.Text = "用户口令更改成功！";
            }
            else
                Lbl_Hite.Text = "用户或口令错误！";
        }
        catch (Exception)
        {
          
        }
    }

Answer 1

  parm[0].Value = TB_UserName.Text;
        parm[1].Value = TB_NewPassword2.Text; 
------------------
  parm[0].Value = TB_UserName.Text.trim();
        parm[1].Value = TB_NewPassword2.Text.trim(); 

Answer 2

DbHelperSQL.ExecuteSql("UPDATE Users SET Password ='" + "?Password" + "' WHERE (User_Name ='" + "?User_Name" + "')"); 

Answer 3

  DbHelperSQL.ExecuteSql("UPDATE Users SET Password ='" + "?User_Name" + "' WHERE (User_Name ='" + "?Password" + "')"); 
pssword 和 user_name 反了