Question

我有2个文本框和2个标签。

标签：UserID＆amp; ACCType。

textbox：Email＆amp;密码。

我想从文本框中查找数据，然后将数据库中的数据插入到2个标签中。

所以，换句话说，我想收集文本框中的电子邮件和密码。从这些信息，我想在标签中插入ID和AccountType。我做错了什么？

        protected void Login_Click(object sender, EventArgs e)
    {
        string UID = UserID.Text;
        string AType = AccType.Text;
        string Email = Email.Text;
        string Password = Password.Text;

        SqlConnection con = new SqlConnection();
        con.ConnectionString = "Data Source=sql2016.fse.network;Initial Catalog=db_1518393_fse_rec; User ID=user_db_1518393_fse_rec; Password=P@55word;";

        Int32 verify;
        string query1 = "Select * from Accounts where Email='" + Email.Text + "' and Password='" + Password.Text + "' ";
        SqlCommand cmd1 = new SqlCommand(query1, con);
        con.Open();
        verify = Convert.ToInt32(cmd1.ExecuteScalar());
        con.Close();
        if (verify > 0)
        {
            //successful
            ErrorMessage.Text += "Logging in...";
            //Response.Redirect("succesful.aspx");

            //display User ID & Account Type


            string query2 = "INSERT * from Accounts where Email='" + Email.Text + "' and Password='" + Password.Text + "' + ID + AccountType";
            //string query2 = "Select Email, Password, ID, AccountType from Accounts(Email, Password, ID, AccountType) " + "Values('" + Email + "', '" + Password + "', '" + UID + "', '" + AType + "')";

        }
        else
        {
            //unsuccessful
            //Response.Redirect("unsuccesful.aspx", true);
            ErrorMessage.Text += "Email or Password incorrect! Please try again.";
        }

    }

Answer 1

这是错误的

    string query2 = "INSERT * from Accounts where Email='" + Email.Text + "' and Password='" + Password.Text + "' + ID + AccountType";

应该是这样的

INSERT INTO table_name (column1, column2, column3, ...)
VALUES (value1, value2, value3, ...);

在W3Schools

中显示

Answer 2

这里很少考虑......

首先，正如许多人注意到的（并且总是会在这里），从不连接commnand文本的字符串。而是用户参数，如下所示：

string query1 = "Select * from Accounts where Email=@Email and Password=@Password ";

cmd.Parameters.Add("@Email", SqlDbType.VarChar).Value = Email.Text;
cmd.Parameters.Add("@Password", SqlDbType.VarChar).Value = Password.Text;

其次，您正在使用仅返回受影响行数的ExecuteScalar。相反，您应该使用DataReader读取数据。像这样：

SqlDataReader reader = cmd1.ExecuteReader();
verify = reader.HasRows;

if (verify)
{
    ErrorMessage.Text += "Logging in...";
    reader.Read();

    this.lblUserId.Text = reader["ID"].ToString();
    //read other data into other labels
}

con.Close();

第三，你INSERT语法错误，应该是这样的：

string query2 = @"
INSERT INTO Accounts 
    (Email, Password, ID, AccountType)
VALUES
    (@Email, @Password, @ID, @AccountType)
";

cmd.Parameters.Add("@Email", SqlDbType.VarChar).Value = Email.Text;
cmd.Parameters.Add("@Password", SqlDbType.VarChar).Value = Password.Text;
cmd.Parameters.Add("@ID", SqlDbType.Int).Value = /* some ID textbox or what ever */;
cmd.Parameters.Add("@AccountType", SqlDbType.Int).Value = /* some value for acc type */;

......第四名：

为什么在用户成功登录后将帐户数据输入到表中？

Answer 3

你说你想从文本框中收集电子邮件和密码后更新标签，如果你的账户表包含字段＆＃39; UserId＆＃39;和＆＃39;帐户类型＆＃39;。您应该使用DataReader而不是ExecuteScalar来验证和读取db中的数据，并使用UserId和AccountType更新标签。以下可以是您的假设答案： -

SqlDataReader dr = cmd1.ExecuteReader();
if(dr.HasRows)
{
  //if email and password is okay
  while(dr.Read())
  {
   //successful
   ErrorMessage.Text += "Logging in...";
   //Response.Redirect("succesful.aspx");

   //display User ID & Account Type
   UserId.Text = (string)dr["userid"];
   AccType.Text = (string)dr["accounttype"];
  }
 }
 else{
    //unsuccessful
    //Response.Redirect("unsuccesful.aspx", true);
    ErrorMessage.Text += "Email or Password incorrect! Please try again.";
 }

最后，我不知道为什么你在登录后尝试将任何数据插入到Account表中。我的意思是你应该更新表上的某些字段，而不是在表中插入新行。

将数据从数据库插入到文本框C＃

3 个答案: