错误“检查与您的MySQL服务器版本相对应的手册”

Question

myReader =  SelectCommand.ExecuteReader();

您的SQL语法中有一个错误；请查看与您的MySQL服务器版本相对应的手册，以便在第1行“password”附近使用正确的语法

MySqlConnection conn = new MySqlConnection("secretstring")
        MySqlCommand SelectCommand = new MySqlCommand("SELECT * FROM userspassword where'" + this.loginuser.Text + "'and password'" + this.passworduser.Text, conn);
        MySqlDataReader myReader;
        conn.Open();
        //myReader = SelectCommand.ExecuteReader();
        myReader =  SelectCommand.ExecuteReader();


        int count = 0;
        while (myReader.Read())
        {
            count = count + 1;
        }
        if (count == 1)
        {
            MessageBox.Show("Correct");
            Form2 pannel = new Form2();
             pannel.Show();
             Hide();

        }
        else if (count > 1)
        {
            MessageBox.Show("More then 1 user logged in");
        }
        else
            MessageBox.Show("Incorrect password or username");
        conn.Close();

Answer 1

缺少用户要比较的字段名

 MySqlCommand SelectCommand = new MySqlCommand("SELECT * FROM userspassword where " +  
        "username = '" + this.loginuser.Text + "' and password = '" + 
         this.passworduser.Text +"'" , conn);

以及字段、值和结尾引号之间的空格。

说，让我指出字符串连接的危险。如果您的一个文本框包含一个单引号，该命令将因语法错误而失败，或者，如果您有恶意用户，他/她可能会准备在输入框中插入Sql文本的Sql注入攻击。

 MySqlCommand SelectCommand = new MySqlCommand("SELECT * FROM userspassword where " +  
        "username = @uname and password = @pwd", conn);
 SelectCommand.Parameters.AddWithValue("@uname",this.loginuser.Text); 
 SelectCommand.Parameters.AddWithValue("@pwd",this.passworduser.Text); 
 myReader =  SelectCommand.ExecuteReader();