JDBC的两个SQL注入的例子

不安全，SQL注入例子：

package com.game.server.db.dao;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

public class UnsafeStatementExample {
    private static final String DB_URL = "jdbc:mysql://localhost:3306/user?useSSL=false&serverTimezone=Asia/Shanghai&allowMultiQueries=true";
    private static final String USER = "root";
    private static final String PASS = "123888";

    public static void main(String[] args) {
        //String userInput = "小黄";  // 假设这是用户     正常输入
        String userInput = "example' OR '1'='1";  // 假设这是用户     SQL非正常正常输入


        //  更新的正常语句
        //String userUpdateInput = "test01";
        String userUpdateInput = "test01'); UPDATE user SET password='newpassword' WHERE id=1; -- ";// 注意 --后有个英式空格

        try (Connection connection = DriverManager.getConnection(DB_URL, USER, PASS)) {
            Statement stmt = connection.createStatement(ResultSet.TYPE_FORWARD_ONLY, ResultSet.CONCUR_READ_ONLY);
            String sql = "SELECT * FROM student WHERE name = '" + userInput + "'";
            ResultSet resultSet = stmt.executeQuery(sql);

            while (resultSet.next()) {
                // 处理结果集
                System.out.println(resultSet.getString("id")+"======"
                        +resultSet.getString("number")+"======"
                        +resultSet.getString("name")+"======"
                +resultSet.getString("age")+"======"+resultSet.getString("math"));
            }

            sql = "INSERT INTO student (id, number, age, chi, math, eng, name) VALUES (102, '12345', 20, 90, 95, 85, '" + userUpdateInput + "')";
            stmt.execute(sql);
        } catch (SQLException e) {
            e.printStackTrace();
        }
    }
}

---

安全的，防SQL注入的例子：

package com.game.server.db.dao;

import com.sun.rowset.CachedRowSetImpl;

import javax.sql.rowset.CachedRowSet;
import java.sql.*;

public class SafeSQLInjectionPreventionExample {
    private static final String DB_URL = "jdbc:mysql://localhost:3306/user?useSSL=false&serverTimezone=Asia/Shanghai&allowMultiQueries=true";
    private static final String USER = "root";
    private static final String PASS = "123888";

    public static void main(String[] args) {
        String userInput = "example' OR '1'='1";  // 模拟恶意用户输入

        String userUpdateInput = "test01'); UPDATE user SET password='newpassword' WHERE id=1; -- ";  // 模拟恶意用户输入 注意 --后有个英式空格

        try (Connection connection = DriverManager.getConnection(DB_URL, USER, PASS)) {
            String sql = "SELECT * FROM user WHERE username = ?";
            PreparedStatement preparedStatement = connection.prepareStatement(sql, ResultSet.TYPE_FORWARD_ONLY, ResultSet.CONCUR_READ_ONLY);
            preparedStatement.setString(1, userInput);
            System.out.println("Executing query with parameter: " + sql + " [userInput=" + userInput + "]");  // 打印执行的 SQL 语句
            ResultSet resultSet = preparedStatement.executeQuery();
            CachedRowSet crs = new CachedRowSetImpl();
            crs.populate(resultSet);
            while (resultSet.next()) {
                // 打印结果集
                System.out.println("Username: " + resultSet.getString("username"));
            }
            //==========================================================================================

            String sql1 = "INSERT INTO student (id, number, age, chi, math, eng, name) VALUES (?, ?, ?, ?, ?, ?, ?)";
            PreparedStatement preparedStatement1 = connection.prepareStatement(sql1);
            preparedStatement1.setLong(1, 1235);
            preparedStatement1.setString(2, "12345");
            preparedStatement1.setInt(3, 20);
            preparedStatement1.setInt(4, 90);
            preparedStatement1.setInt(5, 95);
            preparedStatement1.setInt(6, 85);
            preparedStatement1.setString(7, userUpdateInput);
            System.out.println("Executing query with parameter: " + sql1);
            preparedStatement1.executeUpdate();
            System.out.println("Database modified successfully.");
        } catch (SQLException e) {
            e.printStackTrace();
        }
    }
}

---