JDBC 使用Statement实现用户登录，并使用PreparedStatement解决sql注入问题

Statement实现用户登录流程

public class JDBCDemo4_UserLogin {
    @Test
    public void testLogin() throws Exception {

        String url = "jdbc:mysql:///test?useSSL=false";
        String username = "";
        String password = "";
        Connection conn = DriverManager.getConnection(url, username, password);

        // 接收用户名和密码
        String name = "xiaoming";
        String psd = "123";
        String sql = "select * from user where username = '"+name+"' and password = '"+psd+"'";

        // 获取statement对象
        Statement stat = conn.createStatement();

        // 执行sql
        ResultSet rs = stat.executeQuery(sql);

        // 判断登录是否成功
        if (rs.next()){
            System.out.println("登录成功！");
        }else {
            System.out.println("登录失败！");
        }
    }
}

PreparedStatement解决sql注入问题

public class JDBCDemo5_PreparedStatement {
    @Test
    public void testPreparedStatement() throws Exception {

        String url = "jdbc:mysql:///test?useSSL=false&useServerPrepStmts=true";
        String username = "";
        String password = "";
        Connection conn = DriverManager.getConnection(url, username, password);

        String sql = "select * from user where username = ? and password = ?"; // sql中的参数值使用？占位

        // 获取PreparedStatement对象
        PreparedStatement pstmt= conn.prepareStatement(sql); // 此处要传入sql
        pstmt.setString(1,"xiaoming"); // 参数的位置编号 参数值
        pstmt.setString(2,"123");

        // 执行sql
        ResultSet rs = pstmt.executeQuery(); // 该处不再需要传入sql

        // 判断登录是否成功
        if (rs.next()){
            System.out.println("登录成功！");
        }else {
            System.out.println("登录失败！");
        }
    }
}