sql 注入

 sql injection
 password :'or '1'='1

 

 

 RunTimeException 不用throws
 public User login(String userId,String password){
  User user=findUserById(userId);
  if(user==null){
   throw new UserNotFoundException("用户不存在");
  }
  if(!user.getPassword().equals(password)){
   throw new PasswordNotCorrectException("密码不对");
  }
  return user;
 }