一、关于SQL注入问题
问题代码:
Connection conn = null;
Statement stat = null;
ResultSet rs = null;
// 注册驱动
Class.forName("com.mysql.jdbc.Driver");
// 获取数据库连接
String url = "jdbc:mysql://localhost:3306/数据库名";
String user = "用户";
String pwd = "密码";
conn = DriverManager.getConnection(url, user,pwd);
// 获取数据库操作对象
stat = conn.createStatement();
//执行sql语句
String sql = "select * from t_user where user = '"+userName+"' and pwd = '"+passwd+"'";
rs = stat.executeQuery(sql);
// 处理结果集
if (rs.next()){
return true;
}
问题:
userName = sasas
passwd = sa' or '1' = '1
那么就会出现sql注入现象
语句就会成这样
String sql = "select * from t_user where user = 'sasas' and pwd = 'sa' or '1' = '1'";
那么select语句就会执行成功
怎么解决SQL注入现象?
解决sql注入问题 使用:PreparedStatement(预编译数据库操作对象) 原理:预先对sql语句的框架进行编译,再给sql语句传值
解决代码:
Connection conn = null;
PreparedStatement ps = null;
ResultSet rs = null;
// 注册驱动
Class.forName("com.mysql.jdbc.Driver");
// 获