java SQL注入分析程序

DROP TABLE IF EXISTS `user`;
CREATE TABLE `user` (
  `id` int(10) unsigned NOT NULL auto_increment,
  `name` varchar(45) NOT NULL,
  `passwd` varchar(45) NOT NULL,
  PRIMARY KEY  (`id`)
) ENGINE=InnoDB DEFAULT CHARSET=gb2312;

 

 

 

 

package com.liuxt;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

public class SqlInjection {
 Connection conn=null;
 
 private void initDB(){
  
  try{
   Class.forName("com.mysql.jdbc.Driver");
   conn = DriverManager.getConnection("jdbc:mysql://localhost/test?" +
                                      "user=root&password=G@111111");

  }catch(Exception e){
    e.printStackTrace(); 
  }
  
  
 }

 private boolean queryPreUser(String name, String passwd) {
  PreparedStatement statement=null;
  try {
   String sql=this.ceatePreSql(name,passwd);
   statement=this.conn.prepareStatement(sql);
   System.out.println("sql....."+sql);
   statement.setString(1,name);
   statement.setString(2,passwd);
   ResultSet res=statement.executeQuery();
   int count=0;
   while(res.next()){
    count=res.getInt(1);
    
   }
   
   if(count==1) return true;
   else return false;
   
  } catch (SQLException e) {
   e.printStackTrace();
  }
  finally{
   try {
    statement.close();
   } catch (SQLException e) {
    e.printStackTrace();
   }
   
  }
  return false;
 }
 
 
 

 
 private String ceatePreSql(String name, String passwd) {
  StringBuilder sb=new StringBuilder();
  sb.append("select count(*) as cc from user ");
  sb.append("where name=? ");
  sb.append("and passwd=? ");
  return sb.toString();
 }

 private boolean queryUser(String name, String passwd) {
  Statement statement=null;
  try {
   statement=this.conn.createStatement();
   String sql=this.creatSql(name,passwd);
   System.out.println("sql ....."+sql);
   ResultSet res=statement.executeQuery(sql);
   int count=0;
   while(res.next()){
    count=res.getInt(1);
    
   }
   
   if(count==1) return true;
   else return false;
   
  } catch (SQLException e) {
   e.printStackTrace();
  }
  finally{
   try {
    statement.close();
   } catch (SQLException e) {
    e.printStackTrace();
   }
   
  }
  return false;
 }
 
 
 private String creatSql(String name, String passwd) {
  
  StringBuilder sb=new StringBuilder();
  sb.append("select count(*) as cc from user ");
  sb.append("where name='"+name+"' ");
  sb.append("and passwd='"+passwd+"'");
  //sb.toString();
  return sb.toString();
 }

 public static void main(String[] args) {
  
  SqlInjection dbTest=new SqlInjection();
  dbTest.initDB();
  boolean result;
  result=dbTest.queryUser("test","111");
  System.out.println("query result(in Statement) is ===="+result);
  result=dbTest.queryUser("", "' or 1=1 --'");
  System.out.println("query result(in Statement) is ===="+result);
  result=dbTest.queryUser("' or 1=1 --'", "x");
  System.out.println("query result(in Statement) is ===="+result);
  
  result=dbTest.queryPreUser("test","111");
  System.out.println("query result(in PreparedStatement) is ===="+result);
  result=dbTest.queryPreUser("", "' or 1=1 --'");
  System.out.println("query result(in PreparedStatement) is ===="+result);
  result=dbTest.queryPreUser("' or 1=1 --'", "x");
  System.out.println("query result(in PreparedStatement) is ===="+result);
 }

}

 

运行结果：

 

sql .....select count(*) as cc from user where name='test' and passwd='111'
query result(in Statement) is ====true
sql .....select count(*) as cc from user where name='' and passwd='' or 1=1 --''
query result(in Statement) is ====true
sql .....select count(*) as cc from user where name='' or 1=1 --'' and passwd='x'
query result(in Statement) is ====false
sql.....select count(*) as cc from user where name=? and passwd=?
query result(in PreparedStatement) is ====true
sql.....select count(*) as cc from user where name=? and passwd=?
query result(in PreparedStatement) is ====false
sql.....select count(*) as cc from user where name=? and passwd=?
query result(in PreparedStatement) is ====false