JDBC中的PreparedStatement-防止SQL注入攻击

在JDBC对数据库进行操作的时候，SQL注入是一种常见的针对数据库的注入攻击方式。如下面的代码所演示，在我们的提交字段中掺入了SQL语句，会使得程序的登录校验失效：

package org.lyk.main;   import java.sql.Connection; import java.sql.ResultSet; import java.sql.SQLException; import java.sql.Statement; import java.util.ArrayList; import java.util.List;   import org.apache.commons.dbcp2.BasicDataSource; import org.omg.CORBA.PUBLIC_MEMBER;   import com.mysql.jdbc.DatabaseMetaData;   public class Main {        public static String DBDRIVER = "com.mysql.jdbc.Driver";        public static String DB_URL = "jdbc:mysql://localhost:3306/mldn";        public static String USERNAME = "root";        public static String PASSWORD = "admin";        public static BasicDataSource bds = null;          public static void main(String[] args)        {               dbPoolInit();               System.out.println(verify("LIU YAN' -- ", "XXX"));               System.out.println("///Done~~~");        }          public static void dbPoolInit()        {               bds = new BasicDataSource();               bds.setDriverClassName(DBDRIVER);               bds.setUrl(DB_URL);               bds.setUsername(USERNAME);               bds.setPassword(PASSWORD);        }               public static boolean verify(String name, String password)        {               Connection conn = null;               Statement stmt = null;               ResultSet rs = null;               String sql = "SELECT COUNT(*) FROM user WHERE name='"+name+"' and password='"+password+"';";               System.out.println(sql);                             boolean retVal = false;               try               {                      conn = bds.getConnection();                      stmt = conn.createStatement();                      rs = stmt.executeQuery(sql);                      if(rs.next() && rs.getInt(1) == 1)                      {                            retVal = true;                      }                      //System.out.println(rs.getInt(1));               } catch (SQLException e)               {                      // TODO Auto-generated catch block                      e.printStackTrace();               }               finally               {                      try                      {                            if(conn != null )                                   conn.close();                            if(stmt != null)                                   stmt.close();                            if(rs != null)                                   rs.close();                      }                      catch(Exception exception)                      {                            //ignore all exceptions when closing...                      }               }               return retVal;        } }

 

为了解决这个问题，可以使用PreparedStatement来防止该类型的攻击。

其演示代码如下:

package org.lyk.main;   import java.sql.Connection; import java.sql.PreparedStatement; import java.sql.ResultSet; import java.sql.SQLException;   import org.apache.commons.dbcp2.BasicDataSource;       public class Main {        public static String DBDRIVER = "com.mysql.jdbc.Driver";        public static String DB_URL = "jdbc:mysql://localhost:3306/mldn";        public static String USERNAME = "root";        public static String PASSWORD = "admin";        public static BasicDataSource bds = null;          public static void main(String[] args)        {               dbPoolInit();               System.out.println(verify("LIU YAN' -- ", "XXX"));               System.out.println("///Done~~~");        }          public static void dbPoolInit()        {               bds = new BasicDataSource();               bds.setDriverClassName(DBDRIVER);               bds.setUrl(DB_URL);               bds.setUsername(USERNAME);               bds.setPassword(PASSWORD);        }               public static boolean verify(String name, String password)        {               Connection conn = null;               PreparedStatement stmt = null;               ResultSet rs = null;                             String sql = "SELECT COUNT(*) FROM user WHERE name=? and password=? ;";                             System.out.println(sql);                             boolean retVal = false;               try               {                      conn = bds.getConnection();                      stmt = conn.prepareStatement(sql);                      stmt.setString(1, name);                      stmt.setString(2, password);                                           rs = stmt.executeQuery();                      if(rs.next() && rs.getInt(1) == 1)                      {                            retVal = true;                      }                      //System.out.println(rs.getInt(1));               } catch (SQLException e)               {                      // TODO Auto-generated catch block                      e.printStackTrace();               }               finally               {                      try                      {                            if(conn != null )                                   conn.close();                            if(stmt != null)                                   stmt.close();                            if(rs != null)                                   rs.close();                      }                      catch(Exception exception)                      {                            //ignore all exceptions when closing...                      }               }               return retVal;        } }

转载于:https://www.cnblogs.com/kuillldan/p/5865158.html