我的控制者：

public IActionResult vuln(string input)
{
    using (var connection = new SqlConnection(@"Server=localhost;Database=AspDb;User Id=sa;Password=1234; TrustServerCertificate=true"))
    {
        connection.Open();
        using (var command = new SqlCommand($"SELECT UserName FROM AspDb.dbo.Users WHERE UserName LIKE '%{input}%'", connection))
        {
            using (var reader = command.ExecuteReader())
            {
                var content = new List<string>();
                while (reader.Read())
                {
                    content.Add(reader.GetString(0));
                }
                ViewData["vuln"] = content;
                return View("Example1");
            }
        }
    }
}

我的DB数据模型是：

namespace ASP.Models
{
    public class User
    {
        [Key] // PK 
        public int UserNo { get; set; }

        [Required(ErrorMessage ="UserName!")]
        public string UserName { get; set; }

        [Required(ErrorMessage = "UserId!.")]
        public string UserId { get; set; }

        [Required(ErrorMessage = "UserPassword!.")]
        public string UserPassword { get; set; }
    }
}

和我的前端

<form asp-controller="My Controller" asp-action="vuln">
    <div class="row">

        <div class="col-md-10 offset-md-1">
            <div class="card m-auto" style="max-width:850px">
                <div class="card-body">
                    <form class="d-flex align-items-center">
                        <div class="row">
                            <div class="col-9">
                                <input class="form-control form-control-lg flex-shrink-1 form-control-borderless" type="search" placeholder="search word" name="input">
                            </div>
                            <div class="col-3">
                                <button class="btn btn-success btn-lg" type="submit">search</button>
                            </div>
                        </div>
                    </form>
                </div>
            </div>
            <hr>
            <div class="card m-auto" style="max-width:850px">
                <div class="card-body"><textarea class="form-control" readonly="" style="height: 350px;">@ViewData["vuln"]</textarea></div>
            </div>
        </div>
    </div>
</form>

如果我只搜索用户名的一个字符，则应打印全名。此外，当我单击按钮而不输入任何内容时，应打印所有已保存的用户名。
但我得到的值是
系统.集合.泛型.列表'1[系统.字符串]。
怎样才能正常输出DB表的值？
我用的是C# ASP.NET核心7.0.