sql Ö´Ðнá¹ûΪʲô×ÜÊÇ·µ»Ø-1 - .NET¼¼Êõ / ASP.NET

//µã»÷µÇ¼°´Å¥½øÐеǼ£¬ÎªÊ²Ã´×ÜÊÇÖ´ÐÐ Response.Write("<script> alert('ÕæµÄ´íÁË£¡')</script>");


protected void Button1_Click(object sender, EventArgs e)
  {
  SqlConnection con = new SqlConnection("Server=.;database=Best;uid=sa;");
  con.Open();
  string sql = "select * from Userlogin where username='" + this.TextBox1.Text + "'and Pwd='" + this.TextBox2.Text + "'";
  SqlCommand cmd = new SqlCommand(sql, con);
  int i = Convert.ToInt32(cmd.ExecuteNonQuery());
  con.Close();
  if (i > 0)
  {
  Response.Redirect("Manger.aspx");
  }
  else if (i==0)
  {
  Response.Write("<script> alert('Óû§ÃûºÍÃÜÂë´íÎó£¡')</script>");

  }
  else if(i<0)
  {
  Response.Write("<script> alert('ÕæµÄ´íÁË£¡')</script>");

  }

  }

---

C# code:

string sql = "select * from Userlogin where username='" + this.TextBox1.Text + "'and Pwd='" + this.TextBox2.Text + "'";
Õâ¶Î