MySQL登录凭证正确仍报错：基于HWID校验的DLL注入加载器问题

Hey there, let's dig into why your valid credentials are getting rejected with that "invalid username or password" error. Here are the most common culprits to check, tailored to your MySQL HWID validation + DLL injection setup:

The #1 mistake here is usually unparameterized queries or mismatched password storage formats:

• If you're directly concatenating user input into your SQL string (like $"SELECT * FROM users WHERE username='{txtUser.Text}'"), special characters (quotes, spaces) in credentials can break the query syntax, returning zero results. Fix this with parameterized queries to avoid injection and syntax errors:

  using (MySqlCommand cmd = new MySqlCommand(
      "SELECT * FROM users WHERE username = @user AND password = @pass AND hwid = @hwid", 
      connection))
  {
      cmd.Parameters.AddWithValue("@user", txtUsername.Text);
      cmd.Parameters.AddWithValue("@pass", txtPassword.Text);
      cmd.Parameters.AddWithValue("@hwid", GetHWID());
      // Execute and check results
  }
  

• Double-check if your database stores hashed passwords (MD5, SHA256, etc.). If so, you need to hash the input password first before comparing it to the stored value—comparing plaintext to a hash will always fail.

Even if you think your HWID is correct, small formatting differences can break the match:

• Print the HWID your code generates (e.g., MessageBox.Show(GetHWID())) and compare it character-by-character to the value stored in MySQL. Look for:
  • Case differences (e.g., ABC123 vs abc123)
  • Extra characters (spaces, hyphens, or underscores that aren't in the stored value)
  • Different hardware identifiers entirely (e.g., your code grabs the motherboard serial, but the DB stores a combination of hard drive + MAC address)

Make sure your setup is pointing to the right data:

• Verify your connection string is targeting the correct database, not a test or duplicate instance.
• Check if your MySQL user account has SELECT permissions on the users table. If it doesn't, the query will silently return no results, triggering the "invalid credentials" message.
• Test your query manually in a MySQL client (like phpMyAdmin or MySQL Workbench) using the exact credentials and HWID. If it returns no rows, the problem is in your database data, not your code.

MySQL's string matching can be case-sensitive depending on your database configuration (like the lower_case_table_names setting):

• If your DB has a username Admin but you input admin, a case-sensitive query will fail. Normalize case in your query if needed:

  string query = "SELECT * FROM users WHERE LOWER(username) = LOWER(@user) AND password = @pass AND hwid = @hwid";
  

  Note: Don't normalize case for hashed passwords—hash values are case-sensitive.

If you're using async database calls, make sure you're properly waiting for the operation to complete:

• Avoid checking reader.HasRows before await cmd.ExecuteReaderAsync() finishes. A premature check will always return false, leading to false rejections. Example of correct async flow:

  using (MySqlDataReader reader = await cmd.ExecuteReaderAsync())
  {
      if (reader.HasRows)
      {
          // Credentials valid—proceed with injection
      }
      else
      {
          MessageBox.Show("用户名或密码无效");
      }
  }
  

Your code might be swallowing MySQL errors that would reveal the real issue:

• Wrap your database logic in a try-catch block to catch connection errors, syntax issues, or permission problems:

  try
  {
      // Open connection, execute query
  }
  catch (MySqlException ex)
  {
      MessageBox.Show($"Database error: {ex.Message}");
      // Log this error to debug what's going wrong
  }
  

Start with the manual query test in a MySQL client—if that returns a row, you know the problem is in your code. If not, fix your database data first!

内容的提问来源于stack exchange，提问作者Music Addicted