C＃ - データベースから値を取得できません

Question

私のアプリケーションで私はログインシステムを持っています。基本的なので、暗号化は必要ありません。問題は、ログインするときに資格情報（ユーザー名とパスワード）を挿入しても何もしないということです。私のコードは次のとおりです。

public void iniciarsessaobutton_Click(object sender, EventArgs e) 
{ 
    string txtuser = textusername.Text; 
    string txtpass = textlogin.Text;  

    MySqlCommand cmd = new MySqlCommand("SELECT password FROM empregados WHERE user='" + txtuser + "';", mConn); 
    mConn.Open();   
    MySqlDataReader login = cmd.ExecuteReader();    
    login.Read();    
    string getpass = login["password"].ToString(); 

    if (getpass == txtpass) 
    {     
     mConn.Close(); 
     MessageBox.Show("Sessão iniciada"); 
     Admin adm = new Admin(); 
     this.Hide(); 
     adm.Show(); 
    } 
    else 
    { 
     mConn.Close(); 
     MessageBox.Show("Não foi possivel iniciar sessão. Insira a password corretamente."); 
    }    
} 

Answer 1

私はいくつかの一般的な改善と一緒にコメントで述べたいくつかの修正を提案したいと思います。

public void iniciarsessaobutton_Click(object sender, EventArgs e) 
{ 
    string txtuser = textusername.Text; 
    string txtpass = textlogin.Text; 

    // Put your connection into a using() block 
    using (MySqlConnection conn = new MySqlConnection(variableWithYourConnectionStringHere)) 
    { 
     // Put your commend into a using() block 
     // enclose your column names in backticks to avoid conflict with MySql reserved keywords 
     // add a placeholder (@username) for your parameter 
     // use LIMIT 1 if you only expect 1 row matching your condition 
     using(MySqlCommand cmd = new MySqlCommand("SELECT `password` FROM empregados WHERE `user` = @username LIMIT 1", conn)) 
     { 
      mConn.Open(); 

      // add a parameter with your TextBox value 
      cmd.Parameters.AddWithValue("@username", txtuser); 

      // If you only retrieve 1 value, use ExecuteScalar to return only 1 value 
      // cast the returned object as string 
      string getpass = cmd.ExecuteScalar() as string; 

      if (getpass == txtpass) 
      { 
       MessageBox.Show("Sessão iniciada"); 
       Admin adm = new Admin(); 
       this.Hide(); 
       adm.Show(); 
      } 
      else 
      { 
       MessageBox.Show("Não foi possivel iniciar sessão. Insira a password corretamente."); 
      } 
     } 
    } 
}