主题：如何做防止SQL注入？

Imports MySq-l.Data.MySqlClient

Imports System.Security.Cryptography

Imports System.Text

 

Public Class LoginForm

 

    Private Sub btnLogin_Click(sender As Object, e As EventArgs) Handles btnLogin.Click

        Dim username As String = txtUsername.Text

        Dim password As String = GetMD5Hash(txtPassword.Text)

 

        Using connection As New MySq-lConnection("serve-r=localhost;user id=root;password=your_password;database=your_database")

            Try

                connection.Open()

                Dim query As String = "SELEC-T * FROM users WHERE username = @username AND password = @password"

                Using command As New MySqlCommand(query, connection)

                    command.Parameters.AddWithValue("@username", username)

                    command.Parameters.AddWithValue("@password", password)

 

                    Using reader As MySq-lDataReader = command.ExecuteReader()

                        If reader.HasRows Then

                            MessageBox.Show("登录成功！")

                            ' 这里可以添加代码以进入应用程序的下一个阶段

                        Else

                            MessageBox.Show("用户名或密码不正确。")

                        End If

                    End Using

                End Using

            Catch ex As MySq-lException

                MessageBox.Show("数据库连接失败：" & ex.Message)

            End Try

        End Using

    End Sub

 

    Private Function GetMD5Hash(input As String) As String

        Dim md5 As MD5 = MD5.Create()

        Dim inputBytes As Byte() = Encoding.ASCII.GetBytes(input)

        Dim hashBytes As Byte() = md5.ComputeHash(inputBytes)

        Dim sb As New StringBuilder()

        For Each t As Byte In hashBytes

            sb.Append(t.ToString("X2"))

        Next

        Return sb.ToString()

    End Function

 

End Class