asp中的MySQL异常。网

Question

我尝试使用MySQL在Visual Studio 2017asp.netc#web应用程序登录页面，它显示以下错误：

第33行：queryStr=“从webapp.userregistration中选择*，其中username='”usernameTextBox。文本“'和密码='”passwordTextBox。文本第34行：cmd=新MySql。数据MySQL客户端。MySqlCommand（康涅狄格州queryStr）；第35行：读卡器=cmd。ExecuteReader（）；第36行：第37行：名称=“”；

源文件：C：\用户\HOME\源\repos\网页\网页\default.aspx.cs行：35

堆栈跟踪：

[MySqlException（0x80004005）：您的SQL语法有错误；请查看与您的MySQL server版本对应的手册第1行的正确语法]
MySQL。数据MySQL客户端。MySqlStream。ReadPacket（）309 MySql。数据MySQL客户端。NativeDriver。GetResult（Int32

代码：

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System;
using System.Data;

using MySql.Data;
using MySql.Data.MySqlClient;

namespace WebPage
{
    public partial class _default : System.Web.UI.Page
    {
        MySql.Data.MySqlClient.MySqlConnection conn;
        MySql.Data.MySqlClient.MySqlCommand cmd;
        MySql.Data.MySqlClient.MySqlDataReader reader;
        String name;
        protected void Page_Load(object sender, EventArgs e)
        {
            DoSQLQuery();
        }

        protected void Submit_Click(object sender, EventArgs e)
        {

            String connString = System.Configuration.ConfigurationManager.ConnectionStrings["WebAppConnString"].ToString();
            conn = new MySql.Data.MySqlClient.MySqlConnection(connString);
            conn.Open();
            String queryStr = "";
             queryStr = "SELECT * FROM webapp.userregistration WHERE username='" + usernameTextBox.Text+ "'AND password='" + passwordTextBox.Text;
            cmd = new MySql.Data.MySqlClient.MySqlCommand(queryStr,conn);
            reader = cmd.ExecuteReader();

            name = "";
            while (reader.HasRows && reader.Read())
            {

                {
                    name = reader.GetString(reader.GetOrdinal("username")) + " " + reader.GetString(reader.GetOrdinal("password"));
                }

                //if the data matches the rows (username, password), then you enter to the page
                if (reader.HasRows)
                {
                    Session["uname"] = name;

                    Response.BufferOutput = true;
                    Response.Redirect("login.aspx", false);

                }
                else
                {
                    passwordTextBox.Text = "invalid user";

                }
            }

            reader.Close();
            conn.Close();
        }


        private void DoSQLQuery()
        {
            try
            {

            }
            catch (Exception e)
            {
                passwordTextBox.Text = e.ToString();
            }
        }
    }
}

Answer 1

查询端的字符串同时有错误和危险看这里

您的查询输出

从webapp中选择*。用户注册，其中用户名='admin'和密码='12345

最后一个字符不存在'

cmd = new MySql.Data.MySqlClient.MySqlCommand("SELECT * FROM webapp.userregistration WHERE username = @name  and password=@pas", conn);

cmd.Parameters.AddWithValue("@name", usernameTextBox.Text);
cmd.Parameters.AddWithValue("@pas", passwordTextBox.Text);