asp.netÁ¬mysqlÊý¾Ý¿âµÄÎÊÌ⣿

C# code:
string sql = "select * from userinfo where uname = '" + uname + "' and upassword = '" + upassword + "'";
//ºÍ
string sql = "select * from userinfo where uname = @uname and upassword = @upassword";
MySqlParameter[] paras = new MySqlParameter[]
{
new MySqlParameter("@uname",uname),
new MySqlParameter("@upassword",upassword)
};


±¾À´ÕâÁ½ÖÖд·¨¶¼¿ÉÒԵġ£¡£¡£µÚ¶þÖÖ´«²ÎµÄ·½Ê½»¹¸üºÃЩ¡£¡£¡£

µ«ÊÇÏÖÔÚʹÓõÄÊÇmysqlÊý¾Ý¿â£¬ÓõڶþÖÖ·½Ê½Ôõô¶¼²é²»³öÀ´£¿µ½µ×ÊÇʲôԭÒòÄØ£¿Íû¸ßÈËÖ¸µã£¡

---

MySqlParameterÊÇʲô°¡

@ÊÇsql serverµÄд·¨£¬MysqlûÓÐÓùýÄØ
AccessÓÃÒ»¸ö?´úÌæµÄ

---

°Â£¬sorry
ÄÇÊÇMysqlµÄ²ÎÊýÁбí

---

debugһϿ´¿´ ÄãÄǾäsqlÀïÃæµÃµ½µÄÖµÊÇʲô

---

ÒýÓÃ

debugһϿ´¿´ ÄãÄǾäsqlÀïÃæµÃµ½µÄÖµÊÇʲô

Ò»Ö±ÊÇÕâ¸ö
sql = "select * from userinfo where uname = @uname and upassword = @upassword";