Question

我想在asp.net Web表单中创建一个包含3个角色的身份验证模块。我用一个表用户（id，login，password，role）创建了一个简单的数据库。我有3个角色：user，user2和admin。我希望具有特定角色的用户被重定向到单个页面。

Login.aspx.cs

model.compile()

Result:

的web.config

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data.SqlClient;
using System.Configuration;

namespace WebApplication6
{
    public partial class Login : System.Web.UI.Page
    {
        static string DatabaseConnectionString = System.Configuration.ConfigurationManager.ConnectionStrings["dbtestConnectionStrings"].ConnectionString;
        SqlConnection _connection= new SqlConnection(DatabaseConnectionString);


    protected void Page_Load(object sender, EventArgs e) { 
    }

    protected void LoginButton_Click(object sender, EventArgs e)
    {
        try
        {
            var comm = new SqlCommand("select * from user where login=@login and password=@password", _connection);

            comm.Parameters.AddWithValue("@login", LoginUser.UserName);
            comm.Parameters.AddWithValue("@password", LoginUser.Password);

            _connection.Open();

            var rd = comm.ExecuteReader(); 
            if (rd.HasRows)
            {
                while (rd.Read())
                {
                    Session["UserName"] = rd["login"].ToString();
                    string role = rd["role"].ToString();
                    if (role == "user") Response.Redirect("User/User.aspx");
                    else if (role == "user2") Response.Redirect("User2/User.aspx");
                    else Response.Redirect("Admin/Admin.aspx"); 
                }
            }

            else
            {
                LoginUser.FailureText = "ERROR";
            }

        }
        catch (Exception exception)
        {
            Response.Write(exception.StackTrace);
        }
        }         
    }
}

Answer 1

可以看到两个缺陷

用户是关键字，您将其用作表名
分配参数值时，您指定@

尝试以下代码

protected void LoginButton_Click(object sender, EventArgs e)
    {
        try
        {
            SqlCommand comm = new SqlCommand("select login,role from [user] where login=@login and password=@password", _connection);

            comm.Parameters.AddWithValue("@login", LoginUser.UserName);
            comm.Parameters.AddWithValue("@password", LoginUser.Password);

            _connection.Open();

            SqlDataReader rd = comm.ExecuteReader(); 
            if (rd.HasRows)
            {
                while (rd.Read())
                {
                    Session["UserName"] = rd[0].ToString();
                    string role = rd[1].ToString();
                    if (role == "user") Response.Redirect("User/User.aspx");
                    else if (role == "user2") Response.Redirect("User2/User.aspx");
                    else Response.Redirect("Admin/Admin.aspx"); 
                }
            }

            else
            {
                LoginUser.FailureText = "ERROR";
            }
rd.Close();
_connection.Close();

        }
        catch (Exception exception)
        {
            Response.Write(exception.StackTrace);
        }
        }

Answer 2

看起来像那样：

protected void LoginButton_Click(object sender, EventArgs e)
        {
            try
            {
                var comm = new SqlCommand("select login,role from [user] where login=@login and password=@password", _connection);

                comm.Parameters.AddWithValue("@login", LoginUser.UserName);
                comm.Parameters.AddWithValue("@password", LoginUser.Password);

                _connection.Open();

                SqlDataReader rd = comm.ExecuteReader();

                if (rd.HasRows)
                {
                    while (rd.Read())
                    {
                        Session["UserName"] = rd[0].ToString();
                        string role = rd[1].ToString();

                        if (role == "user") Response.Redirect("User/User.aspx");
                        else if (role == "user2") Response.Redirect("User2/User.aspx");
                        else Response.Redirect("Admin/Admin.aspx");


                    }
                }


                else
                {
                    LoginUser.FailureText = "ERROR";
                }
                rd.Close();
                _connection.Close();

            }
            catch (Exception exception)
            {
                Response.Write(exception.StackTrace);
                Label1.Text = exception.Message;
            }
        }

不使用角色登录（网络表单）

2 个答案: