Java使用JDBC开发 之 SQL注入攻击和解决方案

//2.获得数据库连接 DriverManager类中静态方法

//static Connection getConnection(String url, String user, String password)

//返回值是Connection接口的实现类,在mysql驱动程序

//url: 数据库地址 jdbc:mysql://连接主机IP:端口号//数据库名字

String url = “jdbc:mysql://localhost:3306/mylogon”;

String username = “root”;

String password = “123456”;

Connection con = DriverManager.getConnection(url,username,password);

//3.获得语句执行平台

//Statement createStatement() 获取Statement对象,将SQL语句发送到数据库

Statement stat = con.createStatement();

//4.从控制台输入用户名和密码

Scanner sc = new Scanner(System.in);

String user = sc.nextLine();

String key = sc.nextLine();

//String sql1 = “select * from users where username=‘qwer’ and password=‘1234535’ or 1=1”;

String sql2 = “select * from users where username='”+ user +“‘and password=’”+ key +“'”;

System.out.prin