VB.NET中的用戶驗證

Question

我在VB.NET中實現了用戶驗證的代碼。當我在表單的文本框中輸入用戶名和密碼並單擊提交按鈕時，即使我已爲其編寫代碼，也不會顯示任何消息框。 try-catch塊中是否存在一些問題，或者我缺少一些代碼行？

有人可以指出這段代碼有什麼問題嗎？

 Private Sub Button1_Click(ByVal sender As System.Object, ByVal e As System.EventArgs) Handles Button1.Click 

    If TextBox1.Text = "" Or TextBox2.Text = " " Then 
     MsgBox("Enter a user id and password") 
    End If 
    TextBox1.Text = userid 
    TextBox2.Text = password 

    Try 
     myconnection = New SqlConnection("server=PARTH-PC\SQLEXPRESS;uid=sa;pwd=demo;database=fc") 
     'you need to provide password for sql server 
     myconnection.Open() 

     mycommand = New SqlCommand("select * from student where user id='" & TextBox1.Text & "' and password='" & TextBox2.Text & "')", myconnection) 
     dr = mycommand.ExecuteReader() 

    Catch ex As Exception 
    Finally 



     If (dr IsNot Nothing) Then 

      If (dr.Read()) Then 

       MsgBox("User is authenticated") 
       Form2.Show() 



      Else 
       MsgBox("Please enter correct username and password") 
      End If 


     End If 

    End Try 

    myconnection.Close() 
     End Sub 
    End Class 

Answer 1

使用Trim()和Length方法或String.IsNullOrWhiteSpace()（.NET框架4）檢查空或零長度字符串更多。

If TextBox1.Text.Trim().Length = 0 Or TextBox2.Text.Trim().Length = 0 Then 
    MsgBox("Enter a user id and password") 
    Return 'Terminate this method 
End If 

這裏錯了分配，

Dim userid=TextBox1.Text 
Dim password=TextBox2.Text 

的另一個問題是使用硬編碼的SQL語句。

myconnection = New SqlConnection("server=PARTH-PC\SQLEXPRESS;uid=sa;pwd=demo;database=fc") 
mycommand = New SqlCommand("select * from student where [user id]=@userid and [password]=@password",myconnection) 
mycommand.Parameters.Add("@userid",SqlDbType.VarChar,30).Value = userid 
mycommand.Parameters.Add("@password",SqlDbType.VarChar,30).Value = password 

myconnection.Open() 
dr = mycommand.ExecuteReader() 
Dim isFound as boolean = false 
if dr.Read() Then 
    isFound=true 
End If 
dr.Close() 
myConnection.Close() 

if IsFound Then 
    MsgBox("User is authenticated") 
    Form2.Show() 
Else 
    MsgBox("Please enter correct username and password") 
End If 

Answer 2

我的猜測是，您沒有Option Strict On，並且正在您的Try/Catch塊的Try部分中創建dr。當你到達Finally欄目時，它超出了範圍。您也在吞嚥您的catch塊中沒有throw語句的任何錯誤。

嘗試：

Dim myconnection as SqlConnection 
Dim mycommand as SqlCommand 
Dim dr as SqlDataReader 
Try 
    myconnection = New SqlConnection("server=PARTH-PC\SQLEXPRESS;uid=sa;pwd=demo;database=fc") 
     'you need to provide password for sql server 
    myconnection.Open() 

    mycommand = New SqlCommand("select * from student where user id='" & TextBox1.Text & "' and password='" & TextBox2.Text & "')", myconnection) 
    dr = mycommand.ExecuteReader() 

Catch ex As Exception 
    Throw 
Finally 
    If (dr IsNot Nothing) Then 
     If (dr.Read()) Then 
      MsgBox("User is authenticated") 
      Form2.Show() 
     Else 
      MsgBox("Please enter correct username and password") 
     End If 
    End If 

End Try 

myconnection.Close() 

編輯：傑夫·阿特伍德的Option Strict和Option Explicit聲明

http://www.readmespot.com/question/o/222370/option-strict-on-and--net-for-vb6-programmers

和編碼恐怖article其他鏈接

Answer 3

這樣的：

TextBox1.Text = userid 
TextBox2.Text = password 

看起來不對。除此之外，你可能沒有得到讀者的任何記錄（因爲這條線）..這就是爲什麼你沒有得到任何結果。無論如何，在finally塊上使用它是浪費開銷。

而且你的SQL是錯誤的，它有一個）比需要