private void LoginExecute()
{
//未做防注入
statement = string.Format("select * from staff where Username='******' and Password='******'", User.Username, User.Password);
DataTable table = service.QueryManipulation(statement, connection);
if (table == null)
{
return;
}
if (table.Rows.Count != 0)
{
App.Username = User.Username;
App.No = (int)table.Rows[0]["No"];
//为主窗体提供用户名并关闭登录窗体
MainWindowViewModel vm = new MainWindowViewModel();
if ((string)table.Rows[0]["Authority"] == "Admin")
{
WindowManager.Show("MainWindow", vm);
}
else
{
WindowManager.Show("MainWindowLimited", vm);
}
ToClose = true;
}
else
{
MessageBox.Show("用户名或密码错误!");
}
}
public MyStaffPageViewModel()
{
Me = new StaffViewModel();
Me.Username = App.Username;
statement = string.Format("select No, Name, Gender, date_format(Birthday, '%Y-%m-%d') as Birthday, Department, Position, date_format(EntryDate, '%Y-%m-%d') as EntryDate," +
" date_format(ContractDate, '%Y-%m-%d') as ContractDate, Username, Password, Authority, Status from staff where Username='******'", Me.Username);
connection = new MySqlConnection(
"server=localhost;User Id=admin;password=admin;Database=hr");
service = new MySQLService();
DataTable table = service.QueryManipulation(statement, connection);
Me.No = (int)table.Rows[0]["No"];
Me.Name = (string)table.Rows[0]["Name"];
Me.Gender = (string)table.Rows[0]["Gender"];
Me.Birthday = (string)table.Rows[0]["Birthday"];
Me.Department = (string)table.Rows[0]["Department"];
Me.Position = (string)table.Rows[0]["Position"];
Me.EntryDate = (string)table.Rows[0]["EntryDate"];
Me.ContractDate = (string)table.Rows[0]["ContractDate"];
Me.Status = (string)table.Rows[0]["Status"];
}