VB.NET - ASP.NET - 不正确的用户名/密码（验证）

Question

任何人都可以从代码告诉我什么是错的代码？

如果用户名和密码不匹配，lbl文本应显示“不正确的用户名/密码”。

代码：

Protected Sub btnLogin_Click(sender As Object, e As System.EventArgs) Handles btnLogin.Click 

     Dim conn As New OleDbConnection("Provider=Microsoft.Jet.OLEDB.4.0;Data Source=C:\Users\Brian\Documents\Visual Studio 2010\WebSites\PetLandia\App_Data\db.mdb") 
     Dim cmd As OleDbCommand = New OleDbCommand("SELECT * FROM [User] where Username=? and Password=?", conn) 

     cmd.Parameters.AddWithValue("@Username", txtLogin.Text) 
     cmd.Parameters.AddWithValue("@Password", txtPassword.Text) 




     If (String.IsNullOrEmpty(txtLogin.Text)) Or (String.IsNullOrEmpty(txtPassword.Text)) Then 

      lblLoginError.Text = "One or more fields are empty. Please fill in all the fields" 
      lblLoginError.Visible = True 

     Else 

      conn.Open() 
      Dim read As OleDbDataReader = cmd.ExecuteReader() 

      Try 

       If read.HasRows Then 

        While read.Read() 

         If txtLogin.Text = read.Item("username").ToString And txtPassword.Text = read.Item("password").ToString Then 


          Dim tUsername As String = read.Item("Username").ToString 

          Session("Username") = tUsername 
          Response.Redirect("Default.aspx") 


         End If 
        End While 
       End If 

       read.Close() 
      Catch ex As Exception 
       Response.Write(ex.Message()) 
       lblLoginError.Text = "Incorrect Username/Password." 
       lblLoginError.Visible = True 

      Finally 
       conn.Close() 
      End Try 


     End If 

    End Sub 

Answer 1

你可以试试这个代码。此代码没有TryCatch块。

Protected Sub btnLogin_Click(sender As Object, e As System.EventArgs) Handles btnLogin.Click 

     If (String.IsNullOrEmpty(txtLogin.Text)) Or (String.IsNullOrEmpty(txtPassword.Text)) Then 
      lblLoginError.Text = "One or more fields are empty. Please fill in all the fields" 
      lblLoginError.Visible = True 

     Else 
      Dim conn As New OleDbConnection("Provider=Microsoft.Jet.OLEDB.4.0;Data Source=C:\Users\Brian\Documents\Visual Studio 2010\WebSites\PetLandia\App_Data\db.mdb") 
      Dim cmd As OleDbCommand = New OleDbCommand("SELECT * FROM [User] where Username=? and Password=?", conn) 
      cmd.Parameters.AddWithValue("@Username", txtLogin.Text) 
      cmd.Parameters.AddWithValue("@Password", txtPassword.Text) 
      conn.Open() 
      Dim read As OleDbDataReader = cmd.ExecuteReader()  
        If read.HasRows Then 
         read.Read() 
         Session("Username") = read.Item("Username").ToString 
         read.Close() 
         conn.Close() 'Close connection before Redirecting. 
         Response.Redirect("Default.aspx")  
        Else 
         read.Close() 
         conn.Close() 
         lblLoginError.Text = "Incorrect Username/Password." 
         lblLoginError.Visible = True 

        End If 
      End If 
     End Sub 

Answer 2

取而代之的是catch的写Else的if语句

Answer 3

你写它的方式，“不正确的用户名/密码”将仅抛出一个异常表现。

，如果你想使用的代码为你写它，添加一个ELSE：

If txtLogin.Text = read.Item("username").ToString And txtPassword.Text = read.Item("password").ToString Then 


         Dim tUsername As String = read.Item("Username").ToString 

         Session("Username") = tUsername 
         Response.Redirect("Default.aspx") 
else 
throw new exception("Incorrect Username/Password") 
End If 

Answer 4

您不必从数据库中返回用户名和密码，因为您已经拥有它们。你只需要计算匹配的条目。这大大简化了它。此外，作为果酱表明，最好做什么用的数据库做之前做的用户名和密码字段的值测试：

If (String.IsNullOrEmpty(txtLogin.Text)) OrElse (String.IsNullOrEmpty(txtPassword.Text)) Then 

    lblLoginError.Text = "One or more fields are empty. Please fill in all the fields" 
    lblLoginError.Visible = True 

Else 

    Dim ok As Integer = 0 

    Using conn = New OleDbConnection("Provider=Microsoft.Jet.OLEDB.4.0;Data Source=C:\Users\Brian\Documents\Visual Studio 2010\WebSites\PetLandia\App_Data\db.mdb") 
     Dim cmd As OleDbCommand = New OleDbCommand("SELECT COUNT(*) FROM [User] where Username=? and Password=?", conn) 

     cmd.Parameters.AddWithValue("@Username", txtLogin.Text) 
     cmd.Parameters.AddWithValue("@Password", txtPassword.Text) 

     conn.Open() 
     ok = CInt(cmd.ExecuteScalar()) 
     conn.Close() 
    End Using 

    If ok = 0 Then 
     ' credentials incorrect 
    Else 
     ' credentials correct 
    End If 

End If 

Answer 5

1. 您决定推出自己的安全而导致..
2. 您似乎以明文存储密码，这是一个巨大的安全漏洞和潜在的责任来源。
3. If read.HasRows将在数据库中不存在传递的用户名和密码时为false。也就是说，它不会抛出异常，它只会返回没有行。
4. 你没有拨打Dispose上的一次性物品。
5. 用Select Count(*)简单地调用ExecuteScalar来查看结果是否大于零将会更快。

---

Dim authenticationFailed As Boolean = String.IsNullOrEmpty(txtLogin.Text) _ 
    OrElse String.IsNullOrEmpty(txtPassword.Text) 

If Not authenticationFailed Then 
    Dim connString = "Provider=Microsoft.Jet.OLEDB.4.0..." 
    Using conn = New OleDbConnection(connString) 
     Const sql As String = "Select Count(*) From [User] Where Username=? and Password=?" 
     conn.Open() 
     Using cmd = New OleDbCommand(sql, conn) 
      cmd.Parameters.AddWithValue("@Username", txtLogin.Text) 
      cmd.Parameters.AddWithValue("@Password", txtPassword.Text) 

      Try 
       Dim result = cmd.ExecuteScalar(CommandBehavior.CloseConnection) 
      Catch generatedExceptionName As SqlException 
       authenticationFailed = True 
      End Try 

      authenticationFailed = authenticationFailed _ 
       OrElse Convert.ToInt32(result) <> 1 

      If Not authenticationFailed Then 
       Session("Username") = txtLogin.Text 
      End If 
     End Using 

     conn.Close() 
    End Using 
End If 

If authenticationFailed Then 
    lblLoginError.Text = "Incorrect username and password" 
    lblLoginError.Visible = True 
End If