这只是针对一种数据库漏洞的解决办法
如果查询语句是"select * from T_User where username='" + textBox1.Text + "' and password= '" + textBox2.Text + "'";//这种方法不够安全,因为如果在密码中输入' or '1'='1 同样登录成功,这就是.数据库漏洞
OleDbConnection mycon;
OleDbCommand myCommand;
OleDbDataReader myDataReader;
string myConnectionString = "Provider=Microsoft.Jet.OLEDB.4.0;Data Source=C:\\Documents and Settings\\Administrator\\桌面\\new.mdb";
mycon = new OleDbConnection(myConnectionString);
try
{
mycon.Open();
string cmdstr = "select * from T_User where username= ? and password= ?";
myCommand = new OleDbCommand(cmdstr, mycon);
/
myCommand.Parameters.Clear();//清空参数
OleDbParameter pUsername = new OleDbParameter("cs1",OleDbType.Char);//设置第一个参数
pUsername.Value = textBox1.Text;
myCommand.Parameters.Add(pUsername);
///
OleDbParameter pPassword = new OleDbParameter("cs2", OleDbType.Char);//设置第二个参数
pPassword.Value = textBox2.Text;
myCommand.Parameters.Add(pPassword);
/
myDataReader=myCommand.ExecuteReader();//这边是执行数据库操作
if (myDataReader.HasRows)
{
MessageBox.Show("登录成功");
}
else
{
MessageBox.Show("登录失败");
}
myDataReader.Close();
mycon.Close();
}
catch (Exception e)
{
MessageBox.Show(e.ToString());
}