无效的 SQL语句；期待 'DELETE'、'INSERT'、'PROCEDURE'、'SELECT'、或 'UPDATE'。
求高手指教
protected void Button3_Click(object sender, EventArgs e)
{
string str = ConfigurationManager.ConnectionStrings["Connstr"].ToString();
OleDbConnection conn = new OleDbConnection(str);
conn.Open();
string str2 = "select * from user where name='" + TextBox1.Text + "'and pwd='" + TextBox2.Text + "'";
OleDbCommand com = new OleDbCommand("str2", conn);//初始化查询字符串
OleDbDataReader dr = com.ExecuteReader();//通过调用SqlCommand对象的ExecuteReader()方法，执行SQL语句或存储过程得到一个结果集
dr.Read();//定义记录指
string Lever;
if (dr.HasRows)
{
Lever = dr["zhiwei"].ToString();//获取返回记录中的zhiwei字段值
if (TextBox3.Text != Label1.Text)
{
Label1.Text = GetCheckCode();
Response.Write("<script language='javascript'>alert('用户名、密码或验证码不正确，请重新输入！')</script>");
}
else
{
if (Lever == "0")//判断Lever的级别跳转至管理员界面或普通用户界面
{
Session["pass"] = "admin";
Response.Redirect("mannger.aspx");
}
else
{
Session["pass"] = "guest";
Response.Redirect("index.aspx");
}
}
}
else
{
Response.Write("<script languge='javascript'>alert('该用户名不存在，请注册后登录！')</script>");
}
conn.Close();
}
