diff --git a/src/handlers/auth.rs b/src/handlers/auth.rs
index 4d5f240..a78b0b2 100644
--- a/src/handlers/auth.rs
+++ b/src/handlers/auth.rs
@@ -7,7 +7,7 @@ use tracing::{debug, error, info, warn};
 
 use crate::auth::{generate_token, generate_refresh_token, verify_refresh_token};
 use crate::db;
-use crate::error::ErrorResponse;
+use crate::error::{AppError, ErrorResponse};
 use crate::models::Claims;
 use crate::models::{
     AppState, LoginResponse, RefreshTokenRequest, TokenRefreshResponse,
@@ -472,13 +472,15 @@ pub async fn web_login_confirm(
     let short_code = req.code.trim();
 
     // 查找登录码（模糊匹配，因为存入的是 ASD-XXXXXX 格式）
-    let record: Option<(String, String, chrono::DateTime<chrono::Utc>, Option<i32>)> = sqlx::query_as(
-        "SELECT code, openid, expires_at, user_id FROM web_login_codes WHERE code LIKE $1",
-    )
-    .bind(format!("%{}%", short_code))
-    .fetch_optional(pool.get_ref())
-    .await
-    .unwrap_or(None);
+    let record: Option<(String, String, chrono::DateTime<chrono::Utc>, Option<i32>)> =
+        sqlx::query_as(
+            "SELECT code, openid, expires_at, user_id FROM web_login_codes WHERE code = $1",
+        )
+        .bind(short_code)
+        .fetch_optional(pool.get_ref())
+        .await
+        .ok()
+        .flatten();
 
     let (code, openid, expires_at, existing_user_id) = match record {
         Some(r) => r,