利用 JDBC做用户登录系统（使用 PreparedStatement防止 SQL 注入）

public class JDBCTEST {
    public static void main(String[] args) {
        //初始化界面
        Map<String, String> userLoginInfo = initUI();
        boolean loginSuccess = login(userLoginInfo);
        System.out.println(loginSuccess ? "登录成功" : "登录失败");
    }

    private static boolean login(Map<String, String> userLoginInfo) {
        //先打个登录的标记
        boolean loginSuccess = false;
        //这里使用 JDBC
        ResourceBundle bundle = ResourceBundle.getBundle("jdbctest");
        String driver = bundle.getString("driver");
        String url = bundle.getString("DB_url");
        String username = bundle.getString("username");
        String password = bundle.getString("password");

        Statement statement = null;
        ResultSet resultSet = null;
        Connection connection = null;

        try {
            Class.forName(driver);
            connection = DriverManager.getConnection(url, username, password);
            statement = connection.createStatement();//获取操作数据库的对象
            String sql = "select * from t_user where username = '"+userLoginInfo.get(username)+"' and password = '"+userLoginInfo.get(password)+"'";
            //但是这里会出现有注入的风险，所以需要修改一下
            resultSet = statement.executeQuery(sql);
            if (resultSet.next()) {
                loginSuccess = true;
            }
        } catch (ClassNotFoundException e) {
            e.printStackTrace();
        } catch (SQLException e) {
            e.printStackTrace();
        } finally {
            //4.关闭结果集，数据库操作对象，数据库连接
            try {
                if (statement != null) {
                    statement.close();
                }
            } catch (SQLException e) {
                e.printStackTrace();
            }

            try {
                if (connection != null) {
                    connection.close();
                }
            } catch (SQLException e) {
                e.printStackTrace();
            }

            try {
                if (resultSet != null) {
                    resultSet.close();
                }
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }

        return loginSuccess;
    }
    /**
     * 初始化用户界面
     *
     * @return 用户输入的用户名等登录信息
     */
    private static Map<String, String> initUI() {
        Scanner s = new Scanner(System.in);
        System.out.println("用户名");
        String username = s.nextLine();
        System.out.println("密码");
        String password = s.nextLine();
        Map<String, String> userLoginIninfo = new HashMap<>();
        userLoginIninfo.put("username", username);
        userLoginIninfo.put("password", password);
        return userLoginIninfo;
    }
}

如果想去除注入的影响，则需要改动 login 的里面的部分

 private static boolean login(Map<String, String> userLoginInfo) {
        //先打个登录的标记
        boolean loginSuccess = false;

        String loginName = userLoginInfo.get("Lusername");
        String loginPwd = userLoginInfo.get("Lpassword");


        //这里使用 JDBC
        ResourceBundle bundle = ResourceBundle.getBundle("jdbctest");
        String driver = bundle.getString("driver");
        String url = bundle.getString("DB_url");
        String username = bundle.getString("username");
        String password = bundle.getString("password");

        PreparedStatement preparedStatement = null;//预编译操作的对象
        ResultSet resultSet = null;
        Connection connection = null;

        try {
            Class.forName(driver);
            connection = DriverManager.getConnection(url, username, password);
            String sql = "select * from t_user where loginName = ? and loginPwd = ?";//要先写 sql 语句的框架，其中一个问号表示一个占位符，不能使用单引号括起来
            /**
             * 只要用户提供的信息不参与 SQL 语句的编译过程，问题就解决了
             * 要想用户信息不参与 sql 语句的编译，那么必须使用 PreparedStatement
             * 它的原理是，预先对sql 语句的框架进行编译
             */
            preparedStatement = connection.prepareStatement(sql);
            //占位符的传值，是有下标的，（JDBC 中下标从1开始）
            preparedStatement.setString(1,loginName);
            preparedStatement.setString(2,loginPwd);
            resultSet = preparedStatement.executeQuery();//这里就不需要传 sql 语句了
            if (resultSet.next()) {
                loginSuccess = true;
            }
        } catch (ClassNotFoundException e) {
            e.printStackTrace();
        } catch (SQLException e) {
            e.printStackTrace();
        } finally {
            //4.关闭结果集，数据库操作对象，数据库连接
            try {
                if (preparedStatement != null) {
                    preparedStatement.close();
                }
            } catch (SQLException e) {
                e.printStackTrace();
            }

            try {
                if (connection != null) {
                    connection.close();
                }
            } catch (SQLException e) {
                e.printStackTrace();
            }

            try {
                if (resultSet != null) {
                    resultSet.close();
                }
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }

        return loginSuccess;
    }