学习博客：【MySQL】SQL注入问题及解决

SQL存在漏洞，被攻击会导致数据泄露

package com.yl.lesson02.untils;

import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

//SQL注入
public class SqlInject {
   
    public static void main(String[] args) {
   
        //正常登录
        //login("libai","123456");
        //SQL注入
        login("1'or'1=1", "1'or'1=1");

    }

    public static void login(String username, String password) {
   
        Connection conn = null;
        Statement st = null;
        ResultSet rs = null;
        try {
   
            conn = JdbcUtils.getConnection();   //获取数据库连接
            st = conn.createStatement();    //获取SQL的执行对象
            String sql = "select * from users where `NAME` = '" + username + "' AND `password` = '" + password + "'";
            rs = st.executeQuery(sql);

            while (rs.next()) {
   
                System.out.println(rs.getString("NAME"));
                System.out.println(rs.getString("password"));
            }
        } catch (SQLException e) {
   
            e.printStackTrace();
        } finally {
   
            JdbcUtils.release(conn, st, rs);
        }
    }
}

PreparedStatement对象

增

package com.yl.lesson03;

import com.yl.lesson02.untils.JdbcUti