statement存在sql注入问题
public class StatementUserLoginPart {
public static void main(String[] args) throws ClassNotFoundException, SQLException {
Scanner scanner = new Scanner(System.in);
System.out.println("请输入账号");
String account = scanner.nextLine();
System.out.println("请输入密码");
String password = scanner.nextLine();
Class.forName("com.mysql.cj.jdbc.Driver");
Properties info = new Properties();
info.put("user", "root");
info.put("password", "123456");
Connection connection = DriverManager.getConnection("jdbc:mysql://127.0.0.1:3306/test", info);
Statement statement = connection.createStatement();
String sql = "select * from test.t_user where account = '" + account + "' and PASSWORD = '" + password + "'";
System.out.println(sql);
ResultSet resultSet = statement.executeQuery(sql);
if (resultSet.next()){
System.out.println("登录成功!");
}else {
System.out.println("用户名或密码错误!");
}
resultSet.close();
statement.close();
connection.close();
}
}
运行结果
请输入账号
root
请输入密码
' or '1' = '1
select * from test.t_user where account = 'root' and PASSWORD = '' or '1' = '1'
登录成功!
Process finished with exit code 0