JDBC------SQL注入的问题

前言

sql存在漏洞，会被攻击导致数据泄露，SQL可能会被 or 拼接

一、用Statement对象

package com.zhao.demo02;

import com.zhao.demo02.utils.JdbcUtils;

import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

public class SQLInjection {
    public static void main(String[] args) {
        //login("ZHAO", "123456");
        login("' or '1=1", "' or '1=1");

    }

    //登录业务
    public static void login(String username, String password) {
        Connection conn = null;
        Statement st = null;
        ResultSet rs = null;

        try {
            conn = JdbcUtils.getConnection();
            st = conn.createStatement();

            //SELECT * FROM users WHERE NAME='Wang' AND PASSWORD='123456';
            //SELECT * FROM users WHERE NAME='' or '1=1' AND PASSWORD='' or '1=1';
            String sql = "SELECT * FROM users WHERE NAME='"+username+"' AND PASSWORD='"+password+"'";

            rs = st.executeQuery(sql); // 查询完毕会返回一个结果集

            while(rs.next()) {
                System.out.println(rs.getString("NAME"));
                System.out.println(rs.getString("PASSWORD"));
                System.out.println("====================");
            }

        } catch (SQLException e) {
            e.printStackTrace();
        } finally {
            JdbcUtils.release(rs, st, conn);
        }
    }
}

二、用PreparedStatement对象

PreparedStatement 可以防止SQL注入，效率更好！

package com.zhao.demo03;

import com.zhao.demo02.utils.JdbcUtils;

import java.sql.*;

public class SQLInjection {
    public static void main(String[] args) {
        //login("赵云", "123456");
        login("'' or '1=1'", "'' or '1=1'");

    }

    //登录业务
    public static void login(String username, String password) {
        Connection conn = null;
        PreparedStatement st = null;
        ResultSet rs = null;

        try {
            conn = JdbcUtils.getConnection();

            String sql = "SELECT * FROM users WHERE NAME=? AND PASSWORD=?";

            st = conn.prepareStatement(sql);
            st.setString(1, username);
            st.setString(2, password);

            rs = st.executeQuery(); // 查询完毕会返回一个结果集

            while(rs.next()) {
                System.out.println(rs.getString("NAME"));
                System.out.println(rs.getString("PASSWORD"));
                System.out.println("====================");
            }

        } catch (SQLException e) {
            e.printStackTrace();
        } finally {
            JdbcUtils.release(rs, st, conn);
        }
    }
}