檢查數據庫中是否已存在用戶名

Question

我正在檢查數據庫表「用戶」以查看「用戶名」是否存在，以便無法再次創建相同的用戶名。我希望這是一個驗證器，所以如果用戶名存在，消息框會顯示它存在。

請指導我這個問題，我有以下代碼到目前爲止後面的按鈕來添加，並檢查用戶名是否存在：

private void btnSignupNew_Click(object sender, EventArgs e) 
     { 

      if (txtUsername.Text == "") 
      { 
       errorUsername.SetError(txtUsername, "Enter A Username"); 
      } 

      else if (txtPassword.Text == "") 
      { 
       errorPassword.SetError(txtPassword, "Enter A Valid Password"); 
      } 

       //so if there isnt no error in the fields itll go on and add the data in to the database. 
      else{ 

      //instance of sqlConnection 
      SqlConnection con = new SqlConnection("Data Source=etc"); 

      //instance of sqlCommand 
      SqlCommand cmd = new SqlCommand("INSERT INTO [User] values ('" + txtForename.Text + "', '" + txtSurname.Text + "', '" + txtUsername.Text + "', '" + txtPassword.Text + "')", con); 
      con.Open(); 
      cmd.ExecuteNonQuery(); 

      //query executed correcty or not 
      con.Close(); 

Answer 1

作爲一個良好的初步實踐，嘗試使用Parameters避免SQL，讓您持久注射。

嘗試一些liek這樣的：

private void btnSignupNew_Click(object sender, EventArgs e) 
{ 

    if (txtUsername.Text == "") 
    { 
     errorUsername.SetError(txtUsername, "Enter A Username"); 
    } 
    else if (txtPassword.Text == "") 
    { 
     errorPassword.SetError(txtPassword, "Enter A Valid Password"); 
    } 
    else 
    { 
     using (SqlConnection con = new SqlConnection("Data Source=etc")) 
     { 
      con.Open(); 

      bool exists = false; 

      // create a command to check if the username exists 
      using (SqlCommand cmd = new SqlCommand("select count(*) from [User] where UserName = @UserName", con)) 
      { 
       cmd.Parameters.AddWithValue("UserName", txtUsername.Text); 
       exists = (int)cmd.ExecuteScalar() > 0; 
      } 

      // if exists, show a message error 
      if (exists) 
       errorPassword.SetError(txtUsername, "This username has been using by another user."); 
      else 
      { 
          // does not exists, so, persist the user 
       using (SqlCommand cmd = new SqlCommand("INSERT INTO [User] values (@Forname, @Surname, @Username, @Password)", con)) 
       { 
        cmd.Parameters.AddWithValue("Forname", txtForname.Text); 
        cmd.Parameters.AddWithValue("Surname", txtSurname.Text); 
        cmd.Parameters.AddWithValue("UserName", txtUsername.Text); 
        cmd.Parameters.AddWithValue("Password", txtPassword.Text); 

        cmd.ExecuteNonQuery(); 
       }    
      } 

      con.Close(); 
     } 
    } 
}