string s ="select*from   PassWord   where ID='" + textBox1.Text + "and  password='" + textBox2.Text +  "'";

select*from PassWord where ID='yyy' and  password='xxx'

翻译过来不就是这样吗？不过这样写不过滤下 看样子有sql 漏洞

string s ="select*from   PassWord   where ID='" + textBox1.Text +"'"  + "and  password='" + textBox2.Text +  "'";
为啥不用在中间加一个单引号？？？