MySQL聲明將密碼保存到數據庫？

Question

我有一個關於phpmyadmin的節省了用戶名到MySQL數據庫的SQL語句就像一個魅力：

Dim SQLStatement As String = "INSERT INTO accountinfodb(`Usernames`) VALUES ('" & txtUsername.Text & "')" 

然而

我還索要用戶密碼，我D喜歡存儲以及，所以我雖然這將是有道理的：

Dim SQLStatement As String = "INSERT INTO accountinfodb(`Usernames`, `Passwords`) VALUES ('" & txtUsername.Text & txtPasswd.Text & "')" 

不幸的是，這段代碼不起作用，我得到關於VA的錯誤蓋並打開連接，或者在我的MySQL語法中出現語法錯誤。所以我想知道是否有人知道將用戶名和密碼存儲到我的數據庫中的正確方法？

這是我的完整vb.net代碼。

Imports MySql.Data.MySqlClient 


Public Class frmSignup 
Dim ServerString As String = "Server=localhost;User Id=root;Password=;Database=accountinfo" 
Dim SQLConnection As MySqlConnection = New MySqlConnection 

Private Sub Form3_Load(sender As Object, e As EventArgs) Handles MyBase.Load 
    SQLConnection.ConnectionString = ServerString 

    Try 
     If SQLConnection.State = ConnectionState.Closed Then 
      SQLConnection.Open() 
      MsgBox("Successfully connected to DB") 

     Else 
      SQLConnection.Close() 
      MsgBox("Failed to connect to DB") 
     End If 
    Catch ex As Exception 
     MsgBox(ex.ToString) 

    End Try 
End Sub 

Public Sub SaveAccountInformation(ByRef SQLStatement As String) 
    Dim cmd As MySqlCommand = New MySqlCommand 

    With cmd 
     .CommandText = SQLStatement 
     .CommandType = CommandType.Text 
     .Connection = SQLConnection 
     .ExecuteNonQuery() 
    End With 
    SQLConnection.Close() 
    SQLConnection.Dispose() 
End Sub 

Private Sub btnSignup_Click(sender As Object, e As EventArgs) Handles btnSignup.Click 
    If txtPasswd.Text = txtPasswd2.Text Then 
     MessageBox.Show("Passwords Match!") 

     Dim SQLStatement As String = "INSERT INTO accountinfodb(`Usernames`, `Passwords`) VALUES ('" & txtUsername.Text & txtPasswd.Text & "')" 
     SaveAccountInformation(SQLStatement) 



     MessageBox.Show("Account Successfully Registered") 
    Else 
     MessageBox.Show("Passwords Do Not Match!") 
     txtPasswd.Text = Focus() 
     txtPasswd.Clear() 
     txtPasswd2.Text = Focus() 
     txtPasswd2.Clear() 

    End If 
End Sub 
End Class 

編輯1

@Rahul

我加了你的SQL語句，我的代碼，我給出以下錯誤，當我輸入一個隨機的用戶名/ passwd文件

未處理異常類型'MySql.Data.MySqlClient.MySqlException' 發生在MySql.Data.dll中

其他信息：您的SQL語法有錯誤;檢查 對應於您MariaDB的服務器版本在線路附近使用「測試」）」 1

Answer 1

看看你的SQL INSERT語句 正確的語法手冊，它缺少一個,逗號VALUES部分

VALUES ('" & txtUsername.Text & txtPasswd.Text & "') 
          ^... Here 

你的語句應該看起來像

"INSERT INTO accountinfodb(`Usernames`, `Passwords`) 
VALUES ('" & txtUsername.Text & "','" & txtPasswd.Text & "')" 

Ë dit： 我必須提到您的當前代碼容易受到SQL注入攻擊，原因是您直接將用戶輸入作爲串聯值傳遞。您應該使用SqlParameter並相應地將這些值作爲參數傳遞。樣品將

Dim SQLStatement As String = "INSERT INTO accountinfodb(`Usernames`, `Passwords`) VALUES (@username, @password)" 

    cmd.Parameters.AddWithValue("@username", txtUsername.Text.Trim()) 
    cmd.Parameters.AddWithValue("@password", txtPasswd.Text.Trim())