不如发个帖子记录自己的学习进程把。恩，第一天ado.net基础。

Question

vs小菜ado.net数据库

Answer 1

然后还有就是数据库登陆
using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Data.SqlClient;namespace 联系登陆
{
    class Program
    {
        static void Main(string[] args)
        {
            /*
            string dataDir = AppDomain.CurrentDomain.BaseDirectory;
            if (dataDir.EndsWith(@"\bin\Debug\") || dataDir.EndsWith(@"\bin\Release\"))
            {
                dataDir = System.IO.Directory.GetParent(dataDir).Parent.Parent.FullName;
                AppDomain.CurrentDomain.SetData("DataDirectory", dataDir);            }            Console.WriteLine("请输入用户名");
            string username = Console.ReadLine();
            Console.WriteLine("请输入密码");
            string password = Console.ReadLine();
            using (SqlConnection conn = new SqlConnection(@"Data Source=.\sqlexpress; AttachDBFilename=|DataDirectory|\Database1.mdf;integrated Security=True"))
            {
                conn.Open();
                using (SqlCommand cmd = conn.CreateCommand())
                {
                    cmd.CommandText = "select * from T_Person where Username='"+username+"'";
                    using (SqlDataReader reader = cmd.ExecuteReader())
                    {
                        if (reader.Read())
                        {
                            string dbpassword = reader.GetString(reader.GetOrdinal("PassWord"));
                            if (password == dbpassword)
                            {
                                Console.WriteLine("登陆成功");
                            }
                            else
                            {
                                Console.WriteLine("登录失败");
                            }
                        }
                        else
                        {
                            Console.WriteLine("用户名错误");
                        }
                    }
                }            }*/
            
                
            string dataDir = AppDomain.CurrentDomain.BaseDirectory;
            if (dataDir.EndsWith(@"\bin\Debug\") || dataDir.EndsWith(@"\bin\Release\"))
            {
                dataDir = System.IO.Directory.GetParent(dataDir).Parent.Parent.FullName;
                AppDomain.CurrentDomain.SetData("DataDirectory", dataDir);            }
            while (true)
            {
                Console.WriteLine("请输入用户名");
                string username = Console.ReadLine();
                Console.WriteLine("请输入密码");
                string password = Console.ReadLine();
                using (SqlConnection conn = new SqlConnection(@"Data Source=.\sqlexpress; AttachDBFilename=|DataDirectory|\Database1.mdf;integrated Security=True"))
                {
                    conn.Open();
                    using (SqlCommand cmd = conn.CreateCommand())
                    {
                        cmd.CommandText = "select * from T_Person where UserName='" + username + "'";
                        using (SqlDataReader reader = cmd.ExecuteReader())
                        {
                            if (reader.Read())
                            {
                                string Dbpassword = reader.GetString(reader.GetOrdinal("PassWord"));
                                if (password == Dbpassword)
                                {
                                    Console.WriteLine("ok");                                }
                                else
                                {
                                    Console.WriteLine("shibai");
                                }                            }
                            else
                            {
                                Console.WriteLine("用户名错误");
                            }
                        }
                    }
                }
                Console.ReadKey();
            }
        }
    }
}

Answer 2

挺好的，不过最好不要通过将密码查询出来的方式来验证用户是否能够登录。事实上 select count(*) from table where username = xxx and password = xxx看返回0还是1判断就可以。

Answer 3

这样会不会导致SQL注入漏洞攻击?

Answer 4

这样会不会导致SQL注入漏洞攻击?
你的代码同样会。你应该用sqlParamter代替拼接。

Answer 5

这样会不会导致SQL注入漏洞攻击?
你的代码同样会。你应该用sqlParamter代替拼接。
恩，不好意思，见笑了。我正要学sqlParamter呢。跟着视频一步一步学，很菜鸟。。