string sql="select count(*) from userinfo where user_name='"+this.txtname.Text.Trim()+"' and user_pwd='"+db.getMD5(this.txtpwd.Text.Trim())+"' or 1=1";
此语句会登录成功.
怎样解决这样的问题....在不删除or 1=1的情况下..