如何使用 VB.NET 在 SQL 数据库中返回特定于 1 个用户的数据

Question

此程序要求用户从组合框中选择他们的卡号，然后输入他们的密码。如果他们的密码与数据库中的密码匹配，那么他们就会登录。问题是，我的代码没有选择一个特定的用户，它只需要数据库中的第一个用户，我无法登录任何其他用户，因为我没有不知道如何编写选择特定用户的代码。

这是我到目前为止所写的。我认为问题出在 RetriveAccountInformation() 函数中。在那里的某个地方我需要代码来指定它检索在 cboAccountNumbers 组合框中选择的 CardNumber 的数据。任何帮助表示赞赏。

导入 MySql.Data

导入 MySql.Data.MySqlClient

公开课表1

Dim dbCon As MySqlConnection
Dim strQuery As String = ""
Dim SQLcmd As MySqlCommand
Dim DataReader As MySqlDataReader

Private m_strPass As String
Private m_decBalance As Decimal
Private m_strName As String
Private m_strUserPass As String
Private m_strCardNumber As String



Private Sub Button2_Click(sender As Object, e As EventArgs) Handles btnLogin.Click

    'Assign users guessed password to variable
    m_strUserPass = txtPass.Text

    RetrieveAccountInformation() ' invoke 


    ' determine if PIN number is within valid range
    If m_strUserPass = m_strPass Then
        lblWelcome.Text = "Hi"


    Else

        ' indicate that incorrect password was provided
        lblWelcome.Text = "Sorry, Password the is incorrect." _
           & "Please re-enter the password ."

        ' clear user's previous PIN entry
        m_strUserPass = ""

    End If

    txtPass.Clear() ' clear TextBox

End Sub


' load application Form
Private Sub Form1_Load(sender As System.Object, e As System.EventArgs) Handles MyBase.Load

    'Prepare connection and query
    Try
        dbCon = New MySqlConnection("Server=localhost;Database=test;Uid=root;Pwd=mysql")

        strQuery = "SELECT CardNumber " &
                   "FROM Account"

        SQLcmd = New MySqlCommand(strQuery, dbCon)

        'Open the connection
        dbCon.Open()

        ' create database reader to read information from database
        DataReader = SQLcmd.ExecuteReader

        ' fill ComboBox with account numbers
        While DataReader.Read
            cboAccountNumbers.Items.Add(DataReader("CardNumber"))
        End While

        'Close the connection
        DataReader.Close()
        dbCon.Close()

    Catch ex As Exception
        'Output error message to user with explaination of error
        MsgBox("Failure to communicate" & vbCrLf & vbCrLf & ex.Message)


    End Try
End Sub


' invoke when user provides account number
Private Sub RetrieveAccountInformation()

    ' specify account number of record from which data
    ' will be retrieved
    dbCon = New MySqlConnection("Server=localhost;Database=***;Uid=***;Pwd=***")

    strQuery = "SELECT Password, Name, Balance " &
               "FROM Account"

    SQLcmd = New MySqlCommand(strQuery, dbCon)

    dbCon.Open() ' open database connection

    ' create database reader to read information from database
    DataReader = SQLcmd.ExecuteReader

    DataReader.Read() ' open data reader connection

    ' retrieve PIN number, balance amount and first name
    ' information from database
    m_strPass = Convert.ToString(DataReader("Password"))
    m_decBalance = Convert.ToDecimal(DataReader("Balance"))
    m_strName = Convert.ToString(DataReader("Name"))


    DataReader.Close() ' close data reader connection
    dbCon.Close() ' close database connection
End Sub ' RetrieveAccountInformation

结束类

Answer 1

您需要在 sql 语句中使用 WHERE 子句来检索有关特定用户的信息。
顺便说一句，仅使用密码作为检索您的信息的密钥是不够的（是什么阻止了两个用户使用相同的密码？）所以我想您将密码值和 CardNumber 都传递给您的 RetrieveAccountInformation 并使用这些值来唯一识别帐户中的用户记录。

Private Function RetrieveAccountInformation(cardNum as String, pwd As String) As Boolean

    Dim result as Boolean
    strQuery = "SELECT Password, Name, Balance FROM Account " & _
               "WHERE Password = @pwd AND CardNumber=@card"

    Using dbCon = New MySqlConnection("Server=localhost;Database=***;Uid=***;Pwd=***")
    Using SQLcmd = New MySqlCommand(strQuery, dbCon)
        dbCon.Open() 
        SQLcmd.Parameters.AddWithValue("@pwd", pwd)
        SQLcmd.Parameters.AddWithValue("@card", cardNum)
        Using DataReader = SQLcmd.ExecuteReader

            if DataReader.Read() then
                m_strPass = Convert.ToString(DataReader("Password"))
                m_decBalance = Convert.ToDecimal(DataReader("Balance"))
                m_strName = Convert.ToString(DataReader("Name"))
                result = true
            else
                result = false
            End If
        End Using
    End Using
    End Using
End Function

修改后的函数可以通过这种方式从第一次点击按钮开始调用

Private Sub Button2_Click(sender As Object, e As EventArgs) Handles btnLogin.Click
    Dim result As Boolean 
    if cboAccountNumbers.SelectedValue Is Nothing Then
         MessageBox.Show("Please select a Card Number")
    End If

    result = RetrieveAccountInformation(cboAccountNumbers.SelectedValue.ToString, txtPass.Text) 

    If result = True Then
        lblWelcome.Text = "Hi"
    Else
        ....

我还将您的 Sub 更改为布尔函数，如果您找到了用户，则返回 true，否则返回 false。最后一点，请记住，从安全角度来看，在数据库命令中以明文形式传递密码并不是一个好的做法。人们普遍认为，最安全的方法是在存储密码时使用散列函数，然后将相同的散列应用于密码的明文，然后再通过网络传递值。