SQL注入（PreparedStatement）

来源：互联网发布：人工智能可以思考吗编辑：程序博客网时间：2024/05/18 01:59
public class Demo2 {    //private String name = "ericdfdfdfddfd' OR 1=1 -- ";    private String name= "ericdfdfdfddfd' OR 1=1 -- ";    private String password="123456";    @Test    public void test1(){        Connection conn=null;        Statement stmt=null;        ResultSet rs=null;        try {            conn=JdbcUtil.getConnection();            String sql="select * from users where name='"+name+"' and password='"+password+"'";            stmt = conn.createStatement();            rs=stmt.executeQuery(sql);            if(rs.next()){                System.out.println("登录成功！");            }else{                System.out.println("登录失败！");            }        } catch (Exception e) {            e.printStackTrace();            throw new RuntimeException();        }finally{            JdbcUtil.close(stmt, conn,rs);        }    }    @Test    public void test2(){        Connection conn=null;        PreparedStatement stmt=null;        ResultSet rs=null;        try {            conn=JdbcUtil.getConnection();            String sql="select * from users where name=? and password=?";            stmt=conn.prepareStatement(sql);            stmt.setString(1, name);            stmt.setString(2, password);            rs = stmt.executeQuery();            if(rs.next()){                System.out.println("登录成功！");            }else{                System.out.println("登录失败！");            }        } catch (Exception e) {            e.printStackTrace();            throw new RuntimeException();        }finally{            JdbcUtil.close(stmt, conn,rs);        }    }}
0 0