登录页面（基础2-带有安全防护的）

在DAL中DBhelper查询方法要修改

using System;
using System.Collections.Generic;
using System.Linq;
using System.Text;
using System.Threading.Tasks;
using System.Configuration;
using System.Data;
using System.Data.SqlClient;


namespace DAL
{
    public class DB
    {
        //连接字符串
        private static string strconn = ConfigurationManager.ConnectionStrings["db"].ConnectionString;

        //查询1
        public static DataTable Query(string sql, params SqlParameter[] sqlParameters)
        {
            using (SqlDataAdapter sda = new SqlDataAdapter(sql, strconn))
            {

                if (sqlParameters != null && sqlParameters.Count() > 0)
                    sda.SelectCommand.Parameters.AddRange(sqlParameters);

                using (DataTable dt = new DataTable())
                {
                    sda.Fill(dt);
                    return dt;
                }                    
            }               
        }
        

        //查询2
        public static SqlDataReader QueryReader(string sql, params SqlParameter[] sqlParameters)
        {
            SqlConnection sqlConnection = new SqlConnection(strconn);
            using(SqlCommand sqlCommand=new SqlCommand(sql, sqlConnection))
            {
                if (sqlParameters != null && sqlParameters.Count() > 0)
                    sqlCommand.Parameters.AddRange(sqlParameters);

                sqlConnection.Open();
                return sqlCommand.ExecuteReader(CommandBehavior.CloseConnection);
            }


        }

  
        //增删改
        public static int NonQuery(string sql)
        {
            using(SqlConnection conn=new SqlConnection(strconn))
            {
                using(SqlCommand comm=new SqlCommand(sql, conn))
                {
                    conn.Open();
                    return comm.ExecuteNonQuery();
                }
            }
        }
    }
}

DAL中的UserInfoDAL也要修改

using Model;
using System;
using System.Collections.Generic;
using System.Data.SqlClient;
using System.Linq;
using System.Text;
using System.Threading.Tasks;

namespace DAL
{
   public class UserInfoDAL
    {
        public static UserInfo Select(string name, string pwd)
        {
            //构建查询语句   =   不能like模糊查询
            var sql = $"select * from userinfo where name=@name and pwd=@pwd";
            SqlParameter[] sqlParameters =
            {
                new SqlParameter("@name",name),
                new SqlParameter("@pwd",pwd)
            };
            //修改的方法
            var reader = DB.QueryReader(sql, sqlParameters);
            UserInfo user = null;
            if (reader.Read())
            {
                user = new UserInfo()
                {
                    Id = Convert.ToInt32(reader["Id"]),
                    Name = Convert.ToString(reader["Name"]),
                    Role = Convert.ToInt32(reader["Role"])
                };
            }
            reader.Close();
            return user;
        }

    }
}