Statement和PreparedStatement的区别

登录方法，使用Statement实现，会产生sql注入

package demo13;

import utils.JDBCUtils;

import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.Scanner;

public class Demo04Practice {

    /*登录方法   使用密码a' or 'a' = 'a也可以登录成功，叫做sql注入
    * */
    public static void main(String[] args) {
            //1、键盘录入
        Scanner scanner = new Scanner(System.in);
        System.out.println("请输入姓名：");
        String name=scanner.nextLine();
        System.out.println("请输入密码：");
        String password=scanner.nextLine();
        boolean flag = new Demo04Practice().login(name, password);
        if(flag){
            System.out.println("登录成功");
        }else {
            System.out.println("登录失败");
        }


    }

    public boolean login(String name,String password){
        if (name==null||password==null){
            return false;
        }else {
            Connection connection = null;
            Statement statement = null;
            ResultSet resultSet = null;
            try {
                connection = JDBCUtils.getConnection();
                String sql="select * from student where name ='"+ name +"' and password = '"+ password +"'";
                statement = connection.createStatement();
                resultSet = statement.executeQuery(sql);

                return resultSet.next();//直接返回true或者false
                /*if(resultSet.next()){
                    return true;//如果有下一行返回true
                }else{
                    return false;
                }*/
            } catch (SQLException e) {
                e.printStackTrace();
            }finally {
                JDBCUtils.close(resultSet,statement,connection);
            }

        }
        return false;
    }
}

登录方法 使用PreparedStatement实现，不会再产生sql注入

package demo13;

import utils.JDBCUtils;

import java.sql.*;
import java.util.Scanner;

public class Demo05Practice1 {

    /*登录方法   使用PreparedStatement实现
    * */
    public static void main(String[] args) {
            //1、键盘录入
        Scanner scanner = new Scanner(System.in);
        System.out.println("请输入姓名：");
        String name=scanner.nextLine();
        System.out.println("请输入密码：");
        String password=scanner.nextLine();
        boolean flag = new Demo05Practice1().login(name, password);
        if(flag){
            System.out.println("登录成功");
        }else {
            System.out.println("登录失败");
        }


    }

    public boolean login(String name,String password){
        if (name==null||password==null){
            return false;
        }else {
            Connection connection = null;
            PreparedStatement preparedStatement = null;
            ResultSet resultSet = null;
            try {
                connection = JDBCUtils.getConnection();
                String sql="select * from student where name =? and password = ?";
                preparedStatement = connection.prepareStatement(sql);
                //给？赋值
                preparedStatement.setString(1,name);
                preparedStatement.setString(2,password);
                //执行查询
                resultSet = preparedStatement.executeQuery();//不需要传参sql语句

                return resultSet.next();//直接返回true或者false
                /*if(resultSet.next()){
                    return true;//如果有下一行返回true
                }else{
                    return false;
                }*/
            } catch (SQLException e) {
                e.printStackTrace();
            }finally {
                JDBCUtils.close(resultSet,preparedStatement,connection);
            }

        }
        return false;
    }
}