防御性编程之登录界面-登录次数限制/记录登录时间/超时自动解除锁定

private void LoginBtn_Click(object sender, EventArgs e)
        {
            //判断用户名和密码输入情况
            if(UserName.Text.Length<=0)
            {
                MessageBox.Show("用户名为空，请输入用户名！");
                return;
            }
            if(Password.Text.Length<=0)
            {
                MessageBox.Show("密码不能为空！");
                return;
            }
            string conn = @"server=datasvr;uid=mis;password=mis_2015;database=MIS";
            Helpers.SqlHelper db = new Helpers.SqlHelper(conn);


            //登录方法一
            //string sql = @"select UserName,PassWord from dbo.Users";
            //DataTable dt = db.ExecuteDataTable("select username,password from T_users where username = @userName",new SqlParameter("@username",UserName.Text));


            //String userName = (this.UserName.Text).Trim();
            //String passWord = (this.Password.Text).Trim();
            //for (int i = 0; i < dt.Rows.Count; i++)
            //{
            //    if (userName.Equals(dt.Rows[i][0].ToString()))
            //    {
            //        if (passWord.Equals(dt.Rows[i][1].ToString()))
            //        {
            //            MISMain s = new MISMain();
            //            s.Show();
            //            this.Hide();
            //            //MessageBox.Show("登录成功！");
            //            return;
            //        }
            //        else
            //        {
            //            MessageBox.Show("密码错误,请重新输入！");
            //            return;
            //        }


            //    }
            //    else
            //    {
            //        MessageBox.Show("用户名或密码输入错误,请输入！");
            //        return;
            //    }
            //}

            //方法二
             DataTable dt = db.ExecuteDataTable("select Id,username,password,ErrorTimes,sign_time from T_users where username = @userName",new SqlParameter("@username",UserName.Text));

            //防御性编程，判断过滤条件是否有
            try
            {
                if (dt.Rows.Count <= 0)
                {
                    MessageBox.Show("用户名或密码错误，请输入！");
                }


                if (dt.Rows.Count > 1)
                {
                    MessageBox.Show("用户名重复！");
                }


                DataRow row = dt.Rows[0];
                //显性转换类型
                string dbpassword = (string)row["password"];
                long Id = (long)row["Id"];
                int ErrorTimes = (int)row["ErrorTimes"];
                DateTime dbtime = (DateTime)row["sign_time"];


                //用Timespan函数计算间隔时间差
                DateTime TxtTime = DateTime.Parse(DateTime.Now.ToString());
                TimeSpan timespan = TxtTime - dbtime;

                if (ErrorTimes >= 5)
                {
                    if (timespan.TotalMinutes > 3) //如果超过1分钟即解除锁定
                    {
                        db.ExecuteNonQuery("update T_users set ErrorTimes = 0 where Id = @Id", new SqlParameter("@Id", Id));
                    }
                    else
                    {
                        MessageBox.Show("因密码输错次数过多，该账号已经被禁止登录，请与管理员进行联系或稍候再试!");
                    }
                }
                else
                {
                    if(dbpassword != Password.Text.ToString())
                    {
                        {
                            db.ExecuteNonQuery("update T_users set ErrorTimes = ErrorTimes+1,sign_time = '"+ DateTime.Now+ "' where Id = @Id", new SqlParameter("@ID", Id));
                        }


                         MessageBox.Show("密码错误，请重新输入!");
                    }
                    else
                    {
                                MISMain d = new MISMain();
                                d.Show();
                                this.Hide();
                                db.ExecuteNonQuery("update T_users set ErrorTimes = 0 where Id = @Id", new SqlParameter("@ID", Id));
                    }
                }


            }


            catch(SqlException ex)
            {
                MessageBox.Show(ex.Message);
            }
        }