Question

我建立在c#一個sql查詢來進行登錄，在此我得到一個語法錯誤結束，但我想不出是什麼原因導致的錯誤

SqlDataAdapter sda = new SqlDataAdapter("Select * From bruker Where Brukernavn='" 
         + Textbox1.Text + "' and Passord='" + TextBox2.Text""); 

Answer 1

你缺少一個"+"，你需要通過連接字符串或SqlConnection作爲第二個參數

SqlDataAdapter sda = new SqlDataAdapter("Select * From bruker Where Brukernavn='" + Textbox1.Text + "' and Passord='" + TextBox2.Text +"","connectionString"); 

或

SqlDataAdapter sda = new SqlDataAdapter("Select * From bruker Where Brukernavn='" + Textbox1.Text + "' and Passord='" + TextBox2.Text +"",con); 

由於上述代碼易受sql注入攻擊，請使用下面的代碼來防止sql注入。

try 
{ 
    SqlConnection con = new SqlConnection("connectionString"); 
    SqlCommand commnad = new SqlCommand("Select * From bruker Where Brukernavn=@username and Passord=@password", con); 

    commnad.Parameters.AddWithValue("@username", Textbox1.Text.Trim); 
    commnad.Parameters.AddWithValue("@password", Textbox2.Text.Trim); 
    //rest of the code 
} 
catch(Exception ex) 
{ 
    //log exception and re-throw or send a generic exception message to UI 
    throw; 
} 
finally 
{ 
    //close the connection 
} 

如果能解決您的問題，請將其標記爲答案。