java sql语句防注入,准备好的语句如何防止SQL注入攻击？

这是用于设置示例的SQL：

CREATE TABLE employee(name varchar, paymentType varchar, amount bigint);

INSERT INTO employee VALUES('Aaron', 'salary', 100);

INSERT INTO employee VALUES('Aaron', 'bonus', 50);

INSERT INTO employee VALUES('Bob', 'salary', 50);

INSERT INTO employee VALUES('Bob', 'bonus', 0);

Inject类很容易受到SQL注入攻击 . 查询与用户输入动态粘贴在一起 . 查询的目的是显示有关Bob的信息 . 基于用户输入的工资或奖金 . 但恶意用户操纵输入会破坏查询，方法是将相应的“或者”添加到where子句，以便返回所有内容，包括有关应该隐藏的Aaron的信息 .

import java.sql.*;

public class Inject {

public static void main(String[] args) throws SQLException {

String url = "jdbc:postgresql://localhost/postgres?user=user&password=pwd";

Connection conn = DriverManager.getConnection(url);

Statement stmt = conn.createStatement();

String sql = "SELECT paymentType, amount FROM employee WHERE name = 'bob' AND paymentType='" + args[0] + "'";

System.out.println(sql);

ResultSet rs = stmt.executeQuery(sql);

while (rs.next()) {

System.out.println(rs.getString("paymentType") + " " + rs.getLong("amount"));

}

}

}

运行此操作，第一种情况是正常使用，第二种情况是恶意注入：

c:\temp>java Inject salary

SELECT paymentType, amount FROM employee WHERE name = 'bob' AND paymentType='salary'

salary 50

c:\temp>java Inject "salary' OR 'a'!='b"

SELECT paymentType, amount FROM employee WHERE name = 'bob' AND paymentType='salary' OR 'a'!='b'

salary 100

bonus 50

salary 50

bonus 0

您不应该使用用户输入的字符串连接来构建SQL语句 . 它不仅易受注入攻击，而且还会对服务器产生缓存影响(语句更改，因此不太可能获得SQL语句缓存命中，而绑定示例始终运行相同的语句) .

这是绑定的一个例子，以避免这种注入：

import java.sql.*;

public class Bind {

public static void main(String[] args) throws SQLException {

String url = "jdbc:postgresql://localhost/postgres?user=postgres&password=postgres";

Connection conn = DriverManager.getConnection(url);

String sql = "SELECT paymentType, amount FROM employee WHERE name = 'bob' AND paymentType=?";

System.out.println(sql);

PreparedStatement stmt = conn.prepareStatement(sql);

stmt.setString(1, args[0]);

ResultSet rs = stmt.executeQuery();

while (rs.next()) {

System.out.println(rs.getString("paymentType") + " " + rs.getLong("amount"));

}

}

}

使用与上一示例相同的输入运行此操作会显示恶意代码不起作用，因为没有与该字符串匹配的paymentType：

c:\temp>java Bind salary

SELECT paymentType, amount FROM employee WHERE name = 'bob' AND paymentType=?

salary 50

c:\temp>java Bind "salary' OR 'a'!='b"

SELECT paymentType, amount FROM employee WHERE name = 'bob' AND paymentType=?