有人可以检查我的 VB.net 代码吗？问题解释如下

Question

好的，我已经使用访问数据库在 VB.net 上创建了一个登录系统。我遇到的问题是一些用户名和密码组合工作得很好，但其中一些虽然输入正确，但根本不起作用。这是我写的代码...

Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click

    ' Check if username or password is empty
    If textpassword.Text = "" Or textusername.Text = "" Then
        MessageBox.Show("Please complete the required fields..", "Authentication Error", MessageBoxButtons.OK, MessageBoxIcon.Error)
    Else
        ' Both fields were supplied
        ' Check if user exist in database
        ' Connect to DB
        Dim conn As New System.Data.OleDb.OleDbConnection()
        conn.ConnectionString = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source=|DataDirectory|\database1.accdb"

        'conn.Open()
        'MsgBox("Susscess")

        Dim sql As String = "SELECT * FROM Accounts WHERE username='" & textusername.Text & "' AND password = '" & textpassword.Text & "'"
        Dim sqlCom As New System.Data.OleDb.OleDbCommand(sql)

        'Open Database Connection
        sqlCom.Connection = conn
        conn.Open()

        Dim sqlRead As System.Data.OleDb.OleDbDataReader = sqlCom.ExecuteReader()

        If sqlRead.Read() Then
            MemberPage.Show()
            Me.Hide()

        Else
            ' If user enter wrong username and password combination
            ' Throw an error message
            MessageBox.Show("Username and Password do not match..", "Authentication Failure", MessageBoxButtons.OK, MessageBoxIcon.Exclamation)

            'Clear all fields
            textpassword.Text = ""
            textusername.Text = ""

            'Focus on Username field
            textusername.Focus()
        End If 
    End If 
End Sub

Answer 1

您填写dataReader后检查的条件似乎有误。即

If sqlRead.Read() Then

通过以下代码

尝试 if 条件

If Not sqlRead Is Nothing  Then

如果它不起作用那么..

我建议您使用 DataAdapter 并检查它是否 returns 行。如果行数大于 1 ，则必须显示 MemberPage

Private Sub Button1_Click(sender As Object, e As EventArgs) Handles Button1.Click


    If textpassword.Text = "" Or textusername.Text = "" Then
        MessageBox.Show("Please complete the required fields..", "Authentication Error", MessageBoxButtons.OK, MessageBoxIcon.Error)
    Else

        Dim conn As New System.Data.OleDb.OleDbConnection()
        conn.ConnectionString = "Provider=Microsoft.ACE.OLEDB.12.0;Data Source=|DataDirectory|\database1.accdb"


        Dim sql As String = "SELECT * FROM Accounts WHERE username='" & textusername.Text & "' AND password = '" & textpassword.Text & "'"
        Dim sqlCom As New System.Data.OleDb.OleDbCommand(sql)

        Dim ds As DataSet

        sqlCom.Connection = conn
        conn.Open()

        'Dim sqlRead As System.Data.OleDb.OleDbDataReader = sqlCom.ExecuteReader()

        Dim da as New OleDbDataAdapter(sqlCom)

        da.Fill(ds)

        If ds.Tables(0).Rows.Count > 1  Then
            MemberPage.Show()
            Me.Hide()

        Else

            MessageBox.Show("Username and Password do not match..", "Authentication Failure", MessageBoxButtons.OK, MessageBoxIcon.Exclamation)


            textpassword.Text = ""
            textusername.Text = ""


            textusername.Focus()
        End If 
    End If 
End Sub

Answer 2

不要连接 string.Its 为 SQL 注入敞开。最好使用参数化查询

Dim sql As String = "SELECT * FROM Accounts WHERE username=? AND password = ?"
Dim sqlCom As New System.Data.OleDb.OleDbCommand(sql)
sqlCom.Parameters.AddWithValue("?", textusername.Text);
sqlCom.Parameters.AddWithValue("?", textpassword.Text);

您也可以使用 HasRows 属性

If sqlRead.HasRows Then
      While sqlRead.Read() 
       MemberPage.Show()
       Me.Hide()
      End While
 Else
     MessageBox.Show("Username and Password do not match..", "Authentication Failure", MessageBoxButtons.OK, MessageBoxIcon.Exclamation) 'Clear all fields
        textpassword.Text = ""
        textusername.Text = "" 
      'Focus on Username field
        textusername.Focus()
 End If

有人可以检查我的 VB.net 代码吗？问题解释如下

Can someone check over my VB.net code? Issue explained below

database

vb.net

ms-access-2010