为什么我的登录表单允许用户使用正确的USERNAME但错误的PASSWORD登录？

Question

private void button1_Click(object sender, EventArgs e)
{
    SqlConnection con = new SqlConnection(Sqlconnection.connectionString);
    SqlCommand cmd = new SqlCommand("select * from tbllogin where @username='" + txtname.Text + "' and @password='" + txtpass.Text + "'");
    cmd.Parameters.AddWithValue("@username", txtname.Text);
    cmd.Parameters.AddWithValue("@password", txtpass.Text);
    cmd.Connection = con;
    con.Open();
    SqlDataReader dr = cmd.ExecuteReader();
    if (dr.HasRows)
    {

        MessageBox.Show("Login  Successfully. ..!");
        main m = new main();
        this.Hide();
        m.Show();
    }
 else
    {
       MessageBox.Show("Login Failed....!");
    }
    con.Close();

}

Answer 1

检查您的SELECT语句：

SqlCommand cmd = new SqlCommand("select * from tbllogin where username=@username and password=@password");