asp+mysql__不同类型用户登录

未防注入//0.0

/**
*这里代码应用场景为多类用户登录，根据用户选择不同的单选按钮判断用户登录的类型，
*从而进行不同的数据表进行判断，用户的用户名和密码是否正确。
*/

 public partial class _Default : System.Web.UI.Page
 {
     public string USER = "", PASSWORD = "";//过滤用户的输入
     public int TYPE = -;//验证用户选择的类型，初始值-1
     protected void Page_Load(object sender, EventArgs e)
     {
         if (!IsPostBack)
         {
             username.Text = "";
             password.Text = "";
         }
     }
     protected void Button1_Click(object sender, EventArgs e)//判断用户选择的身份，进行相应的调用函数
     {
         switch (xz.SelectedValue)
         {
             case "": login(); break;
             case "": login(); break;
             case "": login(); break;
         }
     }
     protected void Button2_Click(object sender, EventArgs e) //根据用户选择的身份，跳转到相应的注册页面
     {
         switch (xz.SelectedValue)
         {
             case "":Server.Transfer("zhuce.aspx");  break;
             case "": Server.Transfer("teachaerzhuce.aspx");  break;
             case "": Response.Write("<script>alert('管理员注册未开放！');</script>"); break;
         }

     }
     protected void login(int TYPE)//传人用户选择的类型，执行不同的操作
     {
         string Type = "";
         switch (TYPE)
         {
             case : Type = "同学"; break;
             case : Type = "老师"; break;
             case : Type = "adminsitrator"; break;
         }
         USER = username.Text;
         PASSWORD = password.Text;
         if (yz(TYPE, USER, PASSWORD))//调用yz()函数进行判断
         {
             if (Type != "adminsitrator")
             Response.Write("<script>alert('欢迎 " + Type + " 回家!');</script>");
             Session["id"] = USER.ToString() ;
             Session["bz"] = "yes";//标志
             switch (TYPE)
             {
                 case : Server.Transfer("students.aspx"); break;
                 case : Server.Transfer("teacher.aspx"); break;
                 case : Response.Write("<script>alert('Sorry,administrator 回家了！');</script>");  break;
             }
         }
         else
         {
             Response.Write("<script>alert('sorry,username or password error!');</script>");

         }

     }
     protected bool yz(int TYPE, string USER, string PASSWORD)//根据选则的用户身份，进行验证数据库，成功TRUE，失败FALSE
     {
         string Type = "";
         switch (TYPE)
         {
             case : Type = "stu_"; break;
             case : Type = "tea_"; break;
             case : Type = "admin_"; break;
         }
         string sqlstr = "select * from " + Type + " where " + Type + "user='" + USER + "' and " + Type + "pass='" + DB.MD5Encrypt(PASSWORD) + "';";
         DB db = new DB();//DB类用来对数据库的操作

         MySqlDataReader selectcom = db.Select1(sqlstr);
         while (selectcom.Read())
         {
             return true;
         }
         return false;
     }
 }