创建ASP.net数据库寄存器连接时出错

I'm trying to make this following error: An exception of type 'System.Data.SqlClient.SqlException' occurred in System.Data.dll but was not handled in user code

我正在尝试执行以下错误：System.Data.dll中发生类型'System.Data.SqlClient.SqlException'的异常，但未在用户代码中处理

Additional information: Incorrect syntax near the keyword 'Table'.

附加信息：关键字“表”附近的语法不正确。

    protected void Button_Login_Click(object sender, EventArgs e)
    {
        SqlConnection conn = new SqlConnection(ConfigurationManager.ConnectionStrings["RegisterConnectionString"].ConnectionString);
        conn.Open();
        string checkuser = "select count(*) from [Table] where Användarnamn='" + TextBoxAnvändarelogin.Text + "'";
        SqlCommand com = new SqlCommand(checkuser, conn);
        int temp = Convert.ToInt32(com.ExecuteScalar().ToString());
        conn.Close();
        if (temp == 1)
        {
            conn.Open();
            string checkPasswordQuery = "select password from Table where Användarnamn='" + TextBoxAnvändarelogin.Text + "'";
            SqlCommand passComm = new SqlCommand(checkPasswordQuery, conn);
            string password = passComm.ExecuteScalar().ToString().Replace(" " , ""); // ERROR HERE!
            conn.Close();
            if (password==TextBoxLösenordlogin.Text)
            {
                Session["New"] = TextBoxAnvändarelogin.Text;
                Response.Write("Lösenord är rätt!");
                Response.Redirect("Admin.aspx");
            }
            else
            {
                Response.Write("Lösenord är fel!");
            }
        }
        else
        {
            Response.Write("Användarnamn är inte rätt!");
        }

    }
}

1 个解决方案

#1

string checkPasswordQuery = "select password from Table where Användarnamn
should be
string checkPasswordQuery = "select password from [Table] where Användarnamn

string checkPasswordQuery =“从表中选择密码，其中Användarnamn应该是字符串checkPasswordQuery =”从[表]中选择密码，其中Användarnamn

Side note: it is never a good practice to use string append to build dynamic sql. See Sql Injection for details. And shouldn't use "Table" as a Table name

旁注：使用字符串append构建动态sql绝不是一个好习惯。有关详细信息，请参阅Sql Injection。并且不应该使用“表”作为表名

#1