SQL注入

数据库：mysql5.1

login.jsp：

<form action="login">
	username:<input type="text" name="username"><br>
	password:<input type="password" name="password"><br>
	<input type="submit" value="login">
</form>

LoginServlet：

	@Override
	protected void doPost(HttpServletRequest req, HttpServletResponse resp)
			throws ServletException, IOException {
		String username = req.getParameter("username");
		String password = req.getParameter("password");
		
		String selectSQL = "select username, password, phone from tb_user where username='" + username + "' and password='" + password + "'";
		Statement stmt = null;
		ResultSet rs = null;
		User user = null;
		
		try {
			stmt = DBUtil.createStatement();
			rs = stmt.executeQuery(selectSQL);
			while (rs.next()) {
				user = new User(rs.getString(1), rs.getString(2), rs.getString(3));
			}
		} catch (SQLException e) {
			throw new ServletException(e);
		} finally {
			DBUtil.closeResultSet(rs);
			DBUtil.closeStatement(stmt);
		}
		
		if (user == null) {
			req.getRequestDispatcher("login.jsp").forward(req, resp);
		} else {
			req.setAttribute("user", user);
			req.getRequestDispatcher("login_success.jsp").forward(req, resp);
		}
	}

在登录页面的username，输入：

' or 1=1;-- 

注意：--后面至少要有一个空格。

不输入password，也可以顺利登录。

如果username输入：

' or 1=1;#

不输入password，也可以顺利登录。