在这里先使用statement类示范登录成功,以及失败还有登录的bug
package cs.itcast.jdbc;
import java.sql.*;
import java.util.Scanner;
public class jdbctest01 {
public static boolean login(String username, String password) {
Statement stmt = null;
Connection conn = null;
ResultSet rs = null;
if (username == null || password == null)
return false;
else {
try {
Class.forName("com.mysql.cj.jdbc.Driver");//注册驱动 mysql5之后再services中写过注册
//定义sql
String sql = "select * from user where username='" + username + "' and password = '" + password + "' ";
//获取Connection对象
conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/sys?serverTimezone=GMT&useSSL=false", "root", "root");
//获取执行sql 的对象statement
stmt = conn.createStatement();
//执行sql
rs = stmt.executeQuery(sql);
/* if(rs.next())
return true;
else
return false;
*/
return rs.next();
} catch (SQLException throwables) {
throwables.printStackTrace();
} catch (ClassNotFoundException e) {
e.printStackTrace();
}
}
return true;
}
public static void main(String[] args) {
Scanner sc = new Scanner(System.in);
System.out.println("请输入username");
String username = sc.next();
System.out.println("请输入password");
String password = sc.next();
boolean flag = login(username,password);
if(flag)
System.out.println("登录成功");
else
System.out.println("登录失败");
}
}
数据库中的数据
success
defeat
bug
为什么会出现bug?这样做的系统岂不是很危险!!!原因是输入密码时候使用了sql的关键字
--> or <--,造成了判断的原因 or 左右边只要有一个是true,密码判断就是正确
下面展示使用preparestatement类
PrepareStatement:执行sql对象 1,sql注入问题:在拼接sql时候有特殊sql参与拼接造成安全性问题 1.输入用户名随便 密码:a' or 'a' = 'a 2.解决sql注入问题使用PrepareStatement 3。预编译的sql参数使用占位符?来替代
注意事项
prepareStatement(String sql)是有参数的,返回的值是PreparedStatement类(pstmt)但是preparestatement中的executeQuery();等方法是无参数的;
修改代码后
package cs.itcast.jdbc;
import java.sql.*;
import java.util.Scanner;
/*
5.PrepareStatement:执行sql对象
1,sql注入问题:在拼接sql时候有特殊sql参与拼接造成安全性问题
1.输入用户名随便 密码:a' or 'a' = 'a
2.解决sql注入问题使用PrepareStatement
3。预编译的sql参数使用占位符?来替代
*/
public class jdbctestreal {
public static boolean login(String username, String password) {
PreparedStatement pstmt= null;
Connection conn = null;
ResultSet rs = null;
if (username == null || password == null)
return false;
else {
try {
Class.forName("com.mysql.cj.jdbc.Driver");//注册驱动 mysql5之后再services中写过注册
//定义sql
String sql = "select * from user where username = ? and password = ?";
//获取Connection对象
conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/sys?serverTimezone=GMT&useSSL=false", "root", "root");
//获取执行sql 的对象statement
pstmt = conn.prepareStatement(sql);
//执行sql
pstmt.setString(1,username);
pstmt.setString(2,password);
rs = pstmt.executeQuery();
/* if(rs.next())
return true;
else
return false;
*/
return rs.next();
} catch (SQLException throwables) {
throwables.printStackTrace();
} catch (ClassNotFoundException e) {
e.printStackTrace();
}
}
return true;
}
public static void main(String[] args) {
Scanner sc = new Scanner(System.in);
System.out.println("请输入username");
String username = sc.next();
System.out.println("请输入password");
String password = sc.next();
boolean flag = login(username,password);
if(flag)
System.out.println("登录成功");
else
System.out.println("登录失败");
}
}