Question

您好我正在尝试更改密码，以便在数据库上更新用户的密码。例如，我希望用户Mary Tan的密码从12345更改为54321.但是如果影响用户的其他密码。我真的很想知道如何解决它。

我的代码：

protected void btnChangePassword_Click(object sender, EventArgs e)
        {
            SqlDataReader dr = null;

            connectionString = ConfigurationManager.ConnectionStrings["LeaveManagementCS"].ConnectionString;

            conn = new SqlConnection(connectionString);

            string sql = "UPDATE Staff Set Password=@NewPwd";

            if (Session["Username"] != null)
            { 
                sql += " WHERE UserName='" + Session["Username"].ToString() + "'";
            }

            string newPwd = tbNewPassword.Text;

            try
            {
                cmd = new SqlCommand(sql, conn);

                cmd.Parameters.AddWithValue("@NewPwd", tbNewPassword.Text);

                conn.Open();

                dr = cmd.ExecuteReader();

                while(dr.Read())
                {
                    if ((tbNewPassword.Text == dr["newPwd"].ToString()))
                    {

                    }
                }

                dr.Close();


                int rows = cmd.ExecuteNonQuery();

                if(rows > 0)
                {
                    lblOutput.ForeColor = System.Drawing.Color.Green;
                    lblOutput.Text = "Password has been changed successfully";
                }
                else
                {
                    lblOutput.ForeColor = System.Drawing.Color.Red;
                    lblOutput.Text = "Password does not match with our database records.";
                }
            }
            catch(Exception ex)
            {
                lblOutput.Text = "Error Message: " + ex.Message;
            }
            finally
            {
                if (conn != null)
                    conn.Close();
            }
        }

Answer 1

这意味着您的Session["Username"]在此时执行时为null。因此Where条件将跳过并更新所有行。读者的作用是什么？没有必要，ExecuteNonQuery足以完成此Job，它将返回受影响的行数。所以你可以用以下方式做到这一点：

string connectionString = ConfigurationManager.ConnectionStrings["LeaveManagementCS"].ConnectionString;
if (Session["Username"] != null)
{
    string sql = "UPDATE Staff Set Password=@NewPwd  WHERE UserName=@Username";
    using (SqlConnection conn = new SqlConnection(connectionString))
    {
        conn.Open();
        using (SqlCommand cmd = new SqlCommand(sql, conn))
        {
            cmd.Parameters.AddWithValue("@NewPwd", tbNewPassword.Text);
            cmd.Parameters.AddWithValue("@Username", Session["Username"]);
            int rows = cmd.ExecuteNonQuery();
            if (rows > 0)
            {
                lblOutput.ForeColor = System.Drawing.Color.Green;
                lblOutput.Text = "Password has been changed successfully";
            }
            else
            {
                lblOutput.ForeColor = System.Drawing.Color.Red;
                lblOutput.Text = "Password does not match with our database records.";
            }
        }
    }
}
else
{ 
  // Show message that Session is Empty Can't Proceed
}

重要提示： - 请勿将密码保存为纯文本，Hash and salt them

Answer 2

像这样改变你的方法（在开始时检查Session）

protected void btnChangePassword_Click(object sender, EventArgs e)
{
        if (Session["Username"] == null)
        {
             //User is not logged-in. Display message or handle
             return;
        }
        SqlDataReader dr = null;
        connectionString = ConfigurationManager.ConnectionStrings["LeaveManagementCS"].ConnectionString;
        conn = new SqlConnection(connectionString);
        string sql = "UPDATE Staff Set Password=@NewPwd Where UserName = @UserName";

        string newPwd = tbNewPassword.Text;

        try
        {
            cmd = new SqlCommand(sql, conn);

            cmd.Parameters.AddWithValue("@NewPwd", tbNewPassword.Text);
            cmd.Parameters.AddWithValue("@UserName", Session["Username"].ToString());

            conn.Open();

            dr = cmd.ExecuteReader();

            while (dr.Read())
            {
                if ((tbNewPassword.Text == dr["newPwd"].ToString()))
                {

                }
            }

            dr.Close();


            int rows = cmd.ExecuteNonQuery();

            if (rows > 0)
            {
                lblOutput.ForeColor = System.Drawing.Color.Green;
                lblOutput.Text = "Password has been changed successfully";
            }
            else
            {
                lblOutput.ForeColor = System.Drawing.Color.Red;
                lblOutput.Text = "Password does not match with our database records.";
            }
        }
        catch (Exception ex)
        {
            lblOutput.Text = "Error Message: " + ex.Message;
        }
        finally
        {
            if (conn != null)
                conn.Close();
        }
}

更改ASP.Net中的密码问题

2 个答案: