ASP.NET开发实践--构建安全的Microsoft ASP.NET 应用的最佳实践和技术

Dim cmd As New SqlCommand("select username, password from userinfo where username=@username and password=@passwd", conn)

Dim param As SqlParameter = cmd.Parameters.Add("@username", SqlDbType.NVarChar, 30)
param.Value = userName

param = cmd.Parameters.Add("@passwd", SqlDbType.NVarChar, 30)
param.Value = passwd

conn.Open()
Dim rdr As SqlDataReader = cmd.ExecuteReader()
Dim ok As Boolean = False

Try
If rdr.HasRows() Then

Msg.Text = String.Format("Invalid Logon for {0}, please try again", Server.HtmlEncode(userName))