java存在sql注入吗_存在sql注入式***的最差实践代码（Java新手注意了）

package cn.zhd;

import java.io.*;

import org.apache.log4j.*;

import java.sql.Connection;

import java.sql.DriverManager;

import java.sql.SQLException;

import java.sql.Statement;

import java.sql.ResultSet;

public class LoginDemo {

public void execute(String user,String pass){

boolean foo=false;

try{

Class.forName("com.mysql.jdbc.Driver");

Connection con=DriverManager.getConnection("jdbc:mysql://localhost/students","root","");

Statement stam=con.createStatement();           //存在注入***漏洞:select * from login where user='' or'x'='x' or 'x'='' and '1'

ResultSet rs=stam.executeQuery("select * from login where user='" + user + "' and pass='"+ pass + "'");

while(rs.next()){

foo=true;

}

if(foo){

System.out.println("登陆成功");

}

else

{

System.out.println("用户名密码错误");

}

}catch(ClassNotFoundException e){

e.printStackTrace();

}catch(SQLException e){

e.printStackTrace();

}

}

public static void main(String[] args){

Logger log=Logger.getLogger(LoginDemo.class);

try{

LoginDemo ld=new LoginDemo();

BufferedReader bf=new BufferedReader(new InputStreamReader(System.in));

log.info("请输入用户名");

String bf_str=bf.readLine();

log.info("请输入密码");

String bf2_str=bf.readLine();

bf.close();

ld.execute(bf_str,bf2_str);

}catch(IOException e){

e.printStackTrace();

}

}

}

当输入用户名的时候输入:' or 'x'='x' or '2'='

密码随便输.....

成功登陆了吧.....