防止SQL注入

防止SQL注入

/**
 * 防止SQL注入的方法
 */
public class PreparedStatementUserLoginPart {
	public static void main(String[] args) throws SQLException, ClassNotFoundException {
		Scanner scanner = new Scanner(System.in);
		System.out.println("请输入账号");
		String account = scanner.nextLine();
		System.out.println("请输入密码");
		String password = scanner.nextLine();

		Class.forName("com.mysql.cj.jdbc.Driver");

		//Connection connection = DriverManager.getConnection("jdbc:mysql://127.0.0.1:3306/test", "root", "123456");
		Properties info = new Properties();
		info.put("user", "root");
		info.put("password", "123456");

		Connection connection = DriverManager.getConnection("jdbc:mysql://127.0.0.1:3306/test", info);

		/*
		preparStatement:
		1.编写sql语句 其中动态值部分使用占位符‘？’替代 注意：？只能替代值
		2.创建preparStatement 并且传入动态值
		3.执行sql语句
		 */

		String sql = "select * from test.t_user where account = ? and password = ?";
		PreparedStatement prepareStatement = connection.prepareStatement(sql);
		prepareStatement.setObject(1, account);
		prepareStatement.setObject(2, password);

		ResultSet resultSet = prepareStatement.executeQuery();

		if (resultSet.next()){
			System.out.println("登录成功！");
		}else {
			System.out.println("用户名或密码错误！");
		}

		resultSet.close();
		prepareStatement.close();
		connection.close();

	}
}

运行结果

请输入账号
root
请输入密码
' or '1' = '1
用户名或密码错误！

Process finished with exit code 0