JDBC_演示如何防止SQL注入

该案例需要在数据库中插入一张表格。

create table robin_user_zqk(
id NUMBER(6),
name VARCHAR2(100),
pwd VARCHAR2（100）
);
insert into robin_user_zqk(id,name,pwd)
VALUES (1,'jerry','123')
insert into robin_user_zqk(id,name,pwd)

VALUES (2,'tom','123')

————————————————————————————————————————————————————

package cn.tedu.jdbc.day02;


import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.Statement;
import java.util.Scanner;


/*
 * SQL注入演示
 * 
 */
public class Demo07 {
public static void main(String[] args) {
//获取用户输入
Scanner in = new Scanner(System.in);
System.out.print("用户名：");
String name = in.nextLine();
System.out.print("密码：");
String pwd = in.nextLine();
//检查登录情况
boolean pass = login(name,pwd);
if(pass) {
System.out.println("欢迎您! "+name);
}else {
System.out.println("用户名或者密码错误！");
}
}
/*
* 使用PreparedStatement防止SQL注入
*/
public static boolean login1(String name,String pwd) {
String sql = "select count(*) as c "
+ "from robin_user_zqk "
+ "where name=? and pwd=?";
Connection conn = null;
try {
conn = DBUtils.getConnection();//连接池的getConnection方法，是一个线程阻塞方法
PreparedStatement ps = conn.prepareStatement(sql);
ps.setString(1, name);
ps.setString(2, pwd);
ResultSet rs = ps.executeQuery();
while(rs.next()) {
int n = rs.getInt("c");
return n>=1;
}
} catch (Exception e) {
e.printStackTrace();
}finally {
DBUtils.close(conn);
}
return false;
}
/*
* 检查用户是否能够登录
*/
public static boolean login(String name,String pwd) {
String sql = "select count(*) as c "
+ "from robin_user_zqk "
+ "where name = \'"+name+"\' "
+ "and pwd = \'"+pwd+"\' ";
//不能理解上面的sql语句的话，可以输出看看SQL长什么样子
System.out.println(sql);
Connection conn = null;
try {
conn = DBUtils.getConnection();
Statement st = conn.createStatement();
ResultSet rs = st.executeQuery(sql);
while(rs.next()) {
int n = rs.getInt("c");
return n >= 1;
}
} catch (Exception e) {
e.printStackTrace();
}finally {
DBUtils.close(conn);
}
return false;
}
}