JDBC:createStatement（sql注入）与PrepareStatement（防止sql注入）程序案例代码优化

最新推荐文章于 2023-10-01 18:09:10 发布

羊咩咩a284811

最新推荐文章于 2023-10-01 18:09:10 发布

阅读量525

点赞数

分类专栏：学习经验文章标签： jdbc

本文链接：https://blog.csdn.net/qq_43477676/article/details/112569366

版权

本文通过实例代码对比了使用`createStatement`可能引发的SQL注入问题以及`PrepareStatement`如何有效防止SQL注入。通过将重复代码优化到工具类，提高了代码复用性和安全性。

摘要由CSDN通过智能技术生成

把程序中重复的代码写为一个工具类。
在这里插入图片描述
createStatement

package cn.dao;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.ArrayList;
import java.util.List;

import javax.management.RuntimeErrorException;

import cn.IStudentDao.IStudentDao;
import cn.jdbcUtils.jdbcUtils;
import cn.student.Student;

//实现接口
public class DaoDemo implements IStudentDao{
   
	private static Connection connection ;
	private static Statement state;
	//实现
	private static ResultSet update;
	@Override
	public List<Student> findAll(Student student) {
   
		//创建一个集合储存学生对象
		List<Student> list = new ArrayList<Student>();
		//sql语句命令 SELECT id,NAME,age FROM student_jdbc;
		String sql = "SELECT id,NAME,age FROM student_jdbc;";
			try {
   
				//创建连接
				connection = jdbcUtils.getConnection();
				state = connection.createStatement();
				update = state.executeQuery(sql);
				while(update.next()) {
   
					Student stud = new Student();
					stud.setId(update.getInt("id"));
					stud.setName(update.getString("name"));
					stud.setAge(update.getInt("age"));
					list.add(stud);
				}			
			} catch (SQLException e) {
   
				// TODO Auto-generated catch block
				throw new RuntimeException(e);
			}finally {
   
				 jdbcUtils.closeAll(connection, state, update);
			}						
		    return list;
	}

	@Override
	public void save(Student student) {
   
		//sql语句命令 INSERT INTO student_jdbc(NAME,age) VALUES ("miemie2",19);
		//Student student = new Student();
		String sql = "INSERT INTO student_jdbc(id,NAME,age) VALUES ('"+student.getId()+"','"+student.getName()+"',"+student.getAge()+")";
		
			try {
   
				//创建连接
				connection= jdbcUtils.getConnection();
				//创建实现方法对象
				Statement state = connection.createStatement();
				//实现
				int update = state.executeUpdate(sql);
			} catch (SQLException e) {
   
				// TODO Auto-generated catch block
				throw new RuntimeException(e);
			}finally {
   
				jdbcUtils.closeAll(connection, state, null);
			}
			
		
	}

	@Override
	public void update(Student student) {
   
		//sql语句命令 UPDATE student_jdbc SET age=20 WHERE id=1;
				String sql = "UPDATE student_jdbc SET age="+student.getAge()+",name='"+student.getName()+"' WHERE id="+student.getId()+";";
				try {
   
					//创建连接
					connection= jdbcUtils.getConnection();
					//创建实现方法对象
					Statement state = connection.createStatement();
					//实现
					int update = state.executeUpdate(sql);
				} catch (SQLException e) {
   
					// TODO Auto-generated catch block
					throw new RuntimeException(e);
				}finally {
   
					jdbcUtils.closeAll(connection, state, null);
				}
		
	}

	@Override
	public void delete(int id) {
   
		//sql语句命令 delete from student_jdbc where id=1;
		Student student = new Student();
		String sql = "delete from student_jdbc where id="+id+"";
		try {
   
			//创建连接
			connection= jdbcUtils.getConnection();
			//创建实现方法对象
			Statement state = connection.createStatement();
			//实现
			int update = state