一个关于c#的问题 - 黑马程序员技术交流社区

protected void OK_Click(object sender, EventArgs e)
{
string user = txtUsername.Text.Trim();
string pwd = txtPwd.Text.Trim();
if (user.IndexOf("'") > -1 || user.IndexOf(' ') > -1 || user.IndexOf('"') > -1
|| pwd.IndexOf("'") > -1 || pwd.IndexOf(' ') > -1 || pwd.IndexOf('"') > -1)
{
Response.Write("<script>alert('用户名或密码包含有非法字符！');</script>");
return;
}
string sql = "select * from admin where adminName='" + user + "'and adminPwd='" + pwd + "'";
SqlDataReader dr = DbHelperSQL.ExecuteReader(sql);
if (dr.Read() == true)
{
Session["admin"] = dr["adminName"].ToString();//管理员
DbHelperSQL.ExecuteReader(" update admin set lastlogintime='" + DateTime.Now + "'where adminName='" + user + "';");
Response.Redirect("Admin/ztDefault.aspx");
}
else
{
Response.Write("<script>alert('登录失败，无此用户名或密码不正确！');</script>");
}
//最后关闭阅读器
DbHelperSQL.ExecuteReader(" update admin set lastlogintime='" + DateTime.Now + "'where adminName='" + user + "';");
dr.Close();
}
}

复制代码