我在C＃中遇到了會話問題

Question

我使用「用戶名」和「密碼」登錄頁面，然後到達Order頁面並在會話中添加用戶名。在訂單頁面上，我想顯示用戶客戶ID。因此，我使用sql中的用戶名來獲取字符串中的客戶ID。但是，我無法得到它。

登錄頁面

using System; 
    using System.Collections.Generic; 
    using System.Linq; 
    using System.Web; 
    using System.Web.UI; 
    using System.Web.UI.WebControls; 
    using System.Data; 
    using System.Data.SqlClient; 

    namespace SalesSystem 

{ 
    public partial class Login : System.Web.UI.Page 
    { 
     protected void Page_Load(object sender, EventArgs e) 
     { 

     } 

     protected void btnlogin_Click(object sender, EventArgs e) 
     { 
      string username = txtname.Text; 
      string password = txtpassword.Text; 

      try 
      { 
       string connectionString = "Data Source=(local);Initial Catalog=MOE;Integrated Security=True"; 
       SqlConnection mysqlConnection = new SqlConnection(connectionString); 
       SqlCommand cmd = new SqlCommand(); 
       cmd.Connection = mysqlConnection; 
       cmd.CommandType = CommandType.StoredProcedure; 
       cmd.CommandText = "get_cus_001"; 
       cmd.Parameters.AddWithValue("@cName", username); 
       cmd.Parameters.AddWithValue("@cPsw", password); 
       mysqlConnection.Open(); 
       cmd.ExecuteNonQuery(); 
       SqlDataAdapter adp = new SqlDataAdapter(); 
       adp.SelectCommand = cmd; 

       DataTable dt = new DataTable(); 
       adp.Fill(dt); 
       if (dt.Rows.Count > 0) 
       { 
        Session["customername"] = username; 
        Label3.Text = "Success";      
        Response.Redirect("Order.aspx"); 
       } 
       else 
       { 
        Label3.Text = "Fail"; 
       } 
       //mysqlConnection.Close(); 
      } 
      catch (Exception ex) 
      { 
       Label3.Text = ex.Message; 
      } 


     } 
    } 
} 

訂購頁面

using System; 
using System.Collections.Generic; 
using System.Linq; 
using System.Web; 
using System.Web.UI; 
using System.Web.UI.WebControls; 
using System.Data; 
using System.Data.SqlClient; 

namespace SalesSystem 
{ 
    public partial class Order : System.Web.UI.Page 
    { 
     protected void Page_Load(object sender, EventArgs e) 
     { 


      String customername = (String)Session["customername"]; 
      txtorderdate.Text = customername; 

      SqlConnection connn = new SqlConnection(); 
      connn.ConnectionString = "Data Source=(local);Initial Catalog=MOE;Integrated Security=True"; 
      connn.Open(); 
      SqlCommand res = new SqlCommand("Select CustomerID from Customer where Customername ="+customername +"", connn); 
      SqlDataAdapter adp = new SqlDataAdapter(); 
      adp.SelectCommand = res; 

      DataTable dt = new DataTable(); 
      adp.Fill(dt); 
      txtcustomerid.Text = dt.Rows[0]["CustomerID"].ToString(); 

      try 
      { 
       if (!IsPostBack) 
       { 
        SqlConnection conn = new SqlConnection(); 
        conn.ConnectionString = "Data Source=(local);Initial Catalog=MOE;Integrated Security=True"; 
        conn.Open(); 
        SqlCommand da = new SqlCommand("Select Itemid,ItemName from Item", conn); 
        DropDownList1.DataSource = da.ExecuteReader(); 
        //DataSet ds = new DataSet(); 
        // da.Fill(ds, "Item"); 
        //ddlitemid.DataSource = ds.Tables["Item"].DefaultView; 
        DropDownList1.DataTextField = "Itemname"; 
        DropDownList1.DataValueField = "Itemid"; 
        DropDownList1.DataBind(); 
        conn.Close(); 
       } 
      } 
      catch (Exception ex) 
      { 
       Response.Write(ex.Message); 
      } 
     } 

     protected void btnadd_Click(object sender, EventArgs e) 
     { 

      string orderdate = txtorderdate.Text; 
      string customerid = txtcustomerid.Text; 
      string itemid = DropDownList1.SelectedValue; 
      string qty = txtquantity.Text; 




      SqlConnection con = new SqlConnection(); 
      con.ConnectionString = "Data Source=(local);Initial Catalog=MOE;Integrated Security=True"; 
      con.Open(); 
      SqlCommand result = new SqlCommand("Insert Into [Order](Orderdate,Customerid,Itemid,OQty) Values ('" + orderdate + "','" + customerid + "','" + itemid + "','" + qty + "')", con); 
      result.ExecuteNonQuery(); 
     } 

     protected void DropDownList1_SelectedIndexChanged(object sender, EventArgs e) 
     { 

     } 
    } 
} 

我可以成功登錄，當我到達訂購頁面，顯示有我輸入姓氏附近的語法錯誤對話框。請幫幫我。

Answer 1

改變你的SQL查詢

SqlCommand res = new SqlCommand("Select CustomerID from Customer where Customername ='"+customername +"'", connn); 

Answer 2

您是從database在column類型爲varchar的基礎selecting數據。

varchar值總是需要用quotes包圍，並且您還沒有給出有關customername的報價。

使用parameterized SQL來阻止SQl Injections。改變你的插入查詢這樣

SqlCommand res = new SqlCommand("Select CustomerID from Customer where Customername = @customername " , connn); 
res.Parameters.AddWithValue("@customername",customername); 

Answer 3

很容易受到SQL注入

http://www.codeproject.com/Articles/813965/Preventing-SQL-Injection-Attack-ASP-NET-Part-I

使用此

Answer 4

錯誤是不是在session.Error是在SQL查詢

SqlCommand res = new SqlCommand("Select CustomerID from Customer where Customername ='"+customername +"'", connn);