C# - 无法从数据库中获取值

Question

在我的应用程序中，我有一个登录系统。这是基本的，所以我不需要任何加密。问题是当我想登录时，我插入了凭据（用户名和密码），但它什么也没做。我的代码是：

 public void iniciarsessaobutton_Click(object sender, EventArgs e)
 {
     string txtuser = textusername.Text;
     string txtpass = textlogin.Text;      

     MySqlCommand cmd = new MySqlCommand("SELECT password FROM empregados WHERE user='" + txtuser + "';", mConn);
     mConn.Open();           
     MySqlDataReader login = cmd.ExecuteReader();            
     login.Read();            
     string getpass = login["password"].ToString();

     if (getpass == txtpass)
     {                
         mConn.Close();
         MessageBox.Show("Sessão iniciada");
         Admin adm = new Admin();
         this.Hide();
         adm.Show();
     }
     else
     {
         mConn.Close();
         MessageBox.Show("Não foi possivel iniciar sessão. Insira a password corretamente.");
     }            
 }

Answer 1

我想提出一些在 cmets 中提到的修复以及一些一般性的改进。有关解决的问题，请参阅代码中的我的 cmets：

public void iniciarsessaobutton_Click(object sender, EventArgs e)
{
    string txtuser = textusername.Text;
    string txtpass = textlogin.Text;

    // Put your connection into a using() block
    using (MySqlConnection conn = new MySqlConnection(variableWithYourConnectionStringHere))
    {
        // Put your commend into a using() block
        // enclose your column names in backticks to avoid conflict with MySql reserved keywords
        // add a placeholder (@username) for your parameter
        // use LIMIT 1 if you only expect 1 row matching your condition
        using(MySqlCommand cmd = new MySqlCommand("SELECT `password` FROM empregados WHERE `user` = @username LIMIT 1", conn))
        {
            mConn.Open();

            // add a parameter with your TextBox value
            cmd.Parameters.AddWithValue("@username", txtuser);

            // If you only retrieve 1 value, use ExecuteScalar to return only 1 value
            // cast the returned object as string
            string getpass = cmd.ExecuteScalar() as string;

            if (getpass == txtpass)
            {
                MessageBox.Show("Sessão iniciada");
                Admin adm = new Admin();
                this.Hide();
                adm.Show();
            }
            else
            {
                MessageBox.Show("Não foi possivel iniciar sessão. Insira a password corretamente.");
            }
        }
    }
}