asp+mysql__不同类型用户登录

未防注入//0.0

/**
*这里代码应用场景为多类用户登录，根据用户选择不同的单选按钮判断用户登录的类型，
*从而进行不同的数据表进行判断，用户的用户名和密码是否正确。
*/

public partial class _Default : System.Web.UI.Page 
{   
    public string USER = "", PASSWORD = "";//过滤用户的输入
    public int TYPE = -1;//验证用户选择的类型，初始值-1
    protected void Page_Load(object sender, EventArgs e)
    {
        if (!IsPostBack)
        {
            username.Text = "";
            password.Text = "";
        }
    }
    protected void Button1_Click(object sender, EventArgs e)//判断用户选择的身份，进行相应的调用函数
    {
        switch (xz.SelectedValue)
        {
            case "1": login(1); break;
            case "2": login(2); break;
            case "3": login(3); break;
        }
    }
    protected void Button2_Click(object sender, EventArgs e) //根据用户选择的身份，跳转到相应的注册页面
    {
        switch (xz.SelectedValue)
        {
            case "1":Server.Transfer("zhuce.aspx");  break;
            case "2": Server.Transfer("teachaerzhuce.aspx");  break;
            case "3": Response.Write("<script>alert('管理员注册未开放！');</script>"); break;
        }
        
    }
    protected void login(int TYPE)//传人用户选择的类型，执行不同的操作
    {
        string Type = "";
        switch (TYPE)
        {
            case 1: Type = "同学"; break;
            case 2: Type = "老师"; break;
            case 3: Type = "adminsitrator"; break;
        }
        USER = username.Text;
        PASSWORD = password.Text;
        if (yz(TYPE, USER, PASSWORD))//调用yz()函数进行判断
        {
            if (Type != "adminsitrator")
            Response.Write("<script>alert('欢迎 " + Type + " 回家!');</script>");
            Session["id"] = USER.ToString() ;
            Session["bz"] = "yes";//标志
            switch (TYPE)
            {
                case 1: Server.Transfer("students.aspx"); break;
                case 2: Server.Transfer("teacher.aspx"); break;
                case 3: Response.Write("<script>alert('Sorry,administrator 回家了！');</script>");  break;
            }
        }
        else
        {
            Response.Write("<script>alert('sorry,username or password error!');</script>");

        }

    }
    protected bool yz(int TYPE, string USER, string PASSWORD)//根据选则的用户身份，进行验证数据库，成功TRUE，失败FALSE
    {
        string Type = "";
        switch (TYPE)
        {
            case 1: Type = "stu_"; break;
            case 2: Type = "tea_"; break;
            case 3: Type = "admin_"; break;
        }
        string sqlstr = "select * from " + Type + " where " + Type + "user='" + USER + "' and " + Type + "pass='" + DB.MD5Encrypt(PASSWORD) + "';";
        DB db = new DB();//DB类用来对数据库的操作
      
        MySqlDataReader selectcom = db.Select1(sqlstr);
        while (selectcom.Read())
        {
            return true;
        }
        return false;
    }
}