C# RMACE，因为发送到服务器的数据较少。但是MSSQL也可以缓存临时查询的执行计划。但是，参数是必需的：）感谢您提供的描述性示例。：）@mikeng实际上，存储过程只是为了使用而提高性能，这是一个神话。它可能会提高性能，因为发送到服务器的数据较少。但是MS

---

RMACE，因为发送到服务器的数据较少。但是MSSQL也可以缓存临时查询的执行计划。但是，参数是必需的：）感谢您提供的描述性示例。：）@mikeng实际上，存储过程只是为了使用而提高性能，这是一个神话。它可能会提高性能，因为发送到服务器的数据较少。但是MSSQL也可以缓存临时查询的执行计划。但是，参数是必需的：）

using System;
using System.Collections.Generic;
using System.Linq;
using System.Web;
using System.Web.UI;
using System.Web.UI.WebControls;
using System.Data;
using System.Data.SqlClient;

public partial class LogIn : System.Web.UI.Page
{
    SqlConnection con = new SqlConnection();
    SqlCommand cmd = new SqlCommand();

    protected void Page_Load(object sender, EventArgs e)
    {
        con.ConnectionString = @"Data Source=.\SQLEXPRESS;AttachDbFilename=C:\Users        \Sony\Documents\Library\App_Data\Library.mdf;Integrated Security=True;User     Instance=True";
        cmd.Connection=con;
        con.Open();



    }
protected void  txt_user_TextChanged(object sender, EventArgs e)
{

}
protected void  txt_pass_TextChanged(object sender, EventArgs e)
{

}
protected void  btn_log_Click(object sender, EventArgs e)
{
    cmd.CommandText="select count(*) from user where Username='"+txt_user.Text+"' and     Password='"+txt_pass.Text+"'";
        int count =Convert.ToInt16(cmd.ExecuteScalar());
        if (count==1)
        {
            Response.Redirect("Home.aspx");
        }
        else
        {
            Label1.Text="Invalid Username or Password. Please try again..";
        }
}

select count(*) from [user] ....

cmd.CommandText="select count(*) from [user] where Username=@uname " + 
                "and Password=@upass";
cmd.Parameters.AddWithValue("@uname", txt_user.Text)
cmd.Parameters.AddWithValue("@upass", txt_pass.Text);
int count =Convert.ToInt16(cmd.ExecuteScalar());
......

protected void  btn_log_Click(object sender, EventArgs e)
{

   using(SqlConnection con = new SqlConnection(@"Data Source=.\SQLEXPRESS;AttachDbFilename=" +
                                 @"C:\Users\Sony\Documents\Library\App_Data\Library.mdf;" + 
                                 @"Integrated Security=True;User Instance=True")
    {
        con.Open();
        using(SqlCommand cmd = new SqlCommand("select count(*) from [user] where "+ 
                                   "Username=@uname and Password=@upass", con)
        {
            cmd.Parameters.AddWithValue("@uname", txt_user.Text)
            cmd.Parameters.AddWithValue("@upass", txt_pass.Text);
            int count =Convert.ToInt16(cmd.ExecuteScalar());
            ......
        }
    }
}

select count(*) from [user] where ...

using(SqlCommand cmd = new SqlCommand("dbo.IsValidLogin", con)
{
    cmd.CommandType = CommandType.StoredProcedure;
    cmd.Parameters.AddWithValue("@username", txt_user.Text)
    cmd.Parameters.AddWithValue("@password", txt_pass.Text);
    var isValidLogin =Convert.ToBool(cmd.ExecuteScalar());
    ...
}

CREATE PROC dbo.IsValidLogin
@username nvarchar(50),
@password nvarchar(50)
AS
BEGIN
  SELECT count(1) 
  FROM [user] 
  WHERE Username=@username
  AND Password=@password
END;