C# ADO.NET参数查询

using System;
using System.Collections.Generic;
using System.ComponentModel;
using System.Data;
using System.Data.SqlClient;
using System.Drawing;
using System.Text;
using System.Windows.Forms;

namespace AdoTwo
{
public partial class FLogin : Form
{
public FLogin()
{
InitializeComponent();
}

private void btnOk_Click(object sender, EventArgs e)
{
string tname = txtName.Text.Trim();//a
string tpwd = txtPwd.Text.Trim();//b
//判断用户名密码是否正确其实就是去数据库查询有没有一条数据，
//这条数据是用户名等于用户输入的用户名,
//并且
//密码等于用户输入的密码的一条数据
SqlConnection conn = new SqlConnection("server=.;database=heimablog;uid=sa;pwd=suncoder");
string sql=string.Format("select count(id) from Student where Name='{0}' and Pwd='{1}'",tname,tpwd);
SqlCommand cmd = new SqlCommand(sql, conn);
//cmd.Connection = conn;
//cmd.CommandText = "";
conn.Open();

//SqlDataReader dr = cmd.ExecuteReader();
//if (dr.HasRows)
//{
//    MessageBox.Show("登陆成功");
//}
//while (dr.Read())
//{
//    Console.WriteLine(dr[1].ToString());//+dr["Name"],dr.GetString(1));
//}

object obg = cmd.ExecuteScalar();
int res = Convert.ToInt32(obg);
if (res > 0) { MessageBox.Show("登陆成功"); }
else { MessageBox.Show("登陆失败"); }
}

private void btnLoginPara_Click(object sender, EventArgs e)
{
SqlConnection conn = new SqlConnection("server=.;database=heimablog;uid=sa;pwd=suncoder");
SqlCommand cmd = new SqlCommand("select count(id) from Student where Name=@ass and Pwd=@add", conn);

//第一种写法
//SqlParameter sp = new SqlParameter("@ass", txtName.Text.Trim());
//SqlParameter sp2 = new SqlParameter("@add", txtPwd.Text.Trim());

//cmd.Parameters.Add(sp);
//cmd.Parameters.Add(sp2);

//第二种写法，特殊情况下报错
//cmd.Parameters.Add(new SqlParameter("@ass", txtName.Text.Trim()));
//cmd.Parameters.Add(new SqlParameter("@add", txtPwd.Text.Trim()));

//第三种写法
//SqlParameter[] spa = new SqlParameter[]{
//    new SqlParameter("@ass", txtName.Text.Trim()),
//    new SqlParameter("@add", txtPwd.Text.Trim())
//};
//cmd.Parameters.AddRange(spa);

//第四种写法
//cmd.Parameters.AddWithValue("@ass", txtName.Text.Trim());
//cmd.Parameters.AddWithValue("@add", txtPwd.Text.Trim());

//第五种写法,参数可以为输出参数
//SqlParameter sp = new SqlParameter("@ass", SqlDbType.NVarChar);
//SqlParameter sp2 = new SqlParameter("@add", SqlDbType.Char);
//sp.Value = txtName.Text.Trim();
//sp2.Value = txtPwd.Text.Trim();
//cmd.Parameters.Add(sp);
//cmd.Parameters.Add(sp2);

//第六种写法
SqlParameter sp = new SqlParameter("@ass", SqlDbType.NVarChar) { Value = txtName.Text.Trim() };
SqlParameter sp2 = new SqlParameter("@add", SqlDbType.Char) { Value = txtPwd.Text.Trim() };
cmd.Parameters.Add(sp);
cmd.Parameters.Add(sp2);

conn.Open();

MessageBox.Show(cmd.ExecuteScalar().ToString());

}
}
}