用户登陆代码问题

Question

try
                {
                    string  myconn="Integrated Security=SSPI;User Id=sa;database=jindu2;server=localhost";
                    SqlConnection myconnection=new SqlConnection (myconn);
                    myconnection.Open();//打开数据库连接 
                    string usname="select * from userinfo where username="+textBox1.Text +" and password="+textBox2.Text +"";
                    SqlCommand cmdd = new SqlCommand(usname, myconnection);
                    SqlDataReader   myreader=cmdd.ExecuteReader(); 
                    if(myreader.Read ())                    
                    {
                        Form1 form1=new Form1 ();
                        form1.Show ();
                        this.Dispose ();
                    }
                    else
                        MessageBox.Show ("你输入的密码不正确,请重新输入");
                    myreader.Close ();
                    myconnection.Close ();
                }
            
                catch(Exception   ex)
                {
                    MessageBox.Show (ex.ToString());
                }输入用户名和密码总是提示列名无效,比如用户名li,密码123,则提示列名'li'无效,列名'123'无效
这是什么错误呢,请高手指教

Answer 1

少引号了！string usname="select * from userinfo where username='"+textBox1.Text +"' and password='"+textBox2.Text +"'";

Answer 2

string usname = "select * from userinfo where username = '"+textBox1.Text + "' and password = '"+ textBox2.Text + "'";为什么不用参数 or 存储过程?