VB.NET SQL Server的SELECT COUNT（*） - 的ExecuteNonQuery：Connection屬性尚未初始化

Question

我登錄頁面我的代碼VB.NET代碼：

Private Sub OK_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles OK.Click 

    Try 
     If UsernameTextBox.Text = "" Then 
      MsgBox("Insert your username.") 
      UsernameTextBox.Focus() 
      Return 
     ElseIf PasswordTextBox.Text = "" Then 
      MsgBox("Insert your Passwprd.") 
      PasswordTextBox.Focus() 
      Return 
     Else 
      Dim count As Integer 
      Using con As New OleDbConnection("Provider=SQLOLEDB;Data Source=JUNIOR-PC\SQLEXPRESS;Integrated Security=SSPI;Initial Catalog=ShopHereNow") 
       con.Open() 
       Dim command = New OleDbCommand("Select count(*) from Employees where FirstName = '" & UsernameTextBox.Text & "' and [Password] = '" & PasswordTextBox.Text & "'") 
       count = command.ExecuteNonQuery() 
       con.Close() 
       If count > 0 Then 
        MsgBox("Welcome " & UsernameLabel.Text & "!") 
        Me.Hide() 
        Home.Show() 
       Else 
        MessageBox.Show("Invalid combination. Try again...") 
        Cancel.PerformClick() 
        Return 
       End If 
      End Using 
     End If 
    Catch ex As Exception 
     MessageBox.Show(ex.Message, "ERROR5", MessageBoxButtons.OK, MessageBoxIcon.Error) 
    End Try 
End Sub 

在執行此代碼我得到錯誤閱讀：ExecuteNonQuery: Connection property has not been initialized

請幫助，我可以在哪裏編碼錯誤？

Answer 1

您的代碼有一些錯誤，

1. 使用Parameterized Queries：

   Dim command = New OleDbCommand("Select count(*) from Employees where FirstName =@FirstName and Password = @Password") 
   command.Parameters.AddWithValue("@FirstName", UsernameTextBox.Text) 
   command.Parameters.AddWithValue("@Password", PasswordTextBox.Text) 
   

這是爲了避免SQL Injection Attack AKA For Security

提到的錯誤abov e是因爲你沒有指定你的命令的連接，改變你的Dim command = New OleDbCommand("Select count(*) from Employees where FirstName =@FirstName and Password = @Password")到Dim command = New OleDbCommand("Select count(*) from Employees where FirstName =@FirstName and Password = @Password", **con**)

MsgBox()是一種過時的方法，使用MessegeBox.Show()代替。

請勿使用類別Exception。而是指定特定的異常類型。在這裏，您可能需要SQLException