<?xml version="1.0" encoding="utf-8" ?><rss version="2.0"><channel><title><![CDATA[ddd58367的博客]]></title><description><![CDATA[]]></description><link>https://blog.youkuaiyun.com/ddd58367</link><language>zh-cn</language><generator>https://blog.youkuaiyun.com/</generator><copyright><![CDATA[Copyright &copy; ddd58367]]></copyright><item><title><![CDATA[为什么PrepareStatement可以防止sql注入]]></title><link>https://blog.youkuaiyun.com/ddd58367/article/details/101579717</link><guid>https://blog.youkuaiyun.com/ddd58367/article/details/101579717</guid><author>ddd58367</author><pubDate>Sat, 25 Feb 2017 20:24:00 +0800</pubDate><description><![CDATA[为什么Statement会被sql注入

因为Statement之所以会被sql注入是因为SQL语句结构发生了变化。比如：
"select*from tablename where username='"+uesrname+  
"'and password='"+password+"'"
在用户输入'or true or'之后sql语句结构改变。
select*from tablen...]]></description><category></category></item><item><title><![CDATA[JDBC]]></title><link>https://blog.youkuaiyun.com/ddd58367/article/details/101579715</link><guid>https://blog.youkuaiyun.com/ddd58367/article/details/101579715</guid><author>ddd58367</author><pubDate>Thu, 23 Feb 2017 21:47:00 +0800</pubDate><description><![CDATA[JDBC


加载驱动


Class.forName(driver);
mysql的driver是
com.mysql.jdbc.Driver


创建连接


Connection conn=DriverManager.getConnection(url,user,password);
其中mysql的url为jdbc:mysql://127.0.0.1:3306/数据库名称?cha...]]></description><category></category></item></channel></rss>