jdbc学习2_statement 和prepareStatement

最新推荐文章于 2022-09-06 16:35:42 发布

原创最新推荐文章于 2022-09-06 16:35:42 发布 · 106 阅读

0 ·

CC 4.0 BY-SA版权

jdbc 专栏收录该内容

10 篇文章

订阅专栏

本文通过两个示例介绍了如何使用 Java 的 JDBC 进行数据库操作，并演示了一个 SQL 注入攻击的例子。首先展示了如何使用 PreparedStatement 插入数据，接着说明了直接拼接 SQL 语句可能导致的安全风险。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

一、

   @Test
   public void testPreparedStatement() {
       Connection connection = null;
       PreparedStatement preparedStatement = null;

       try {
           connection = JDBCTools.getConnection();
           String sql = "INSERT INTO customers (name, email, birth) "
                   + "VALUES(?,?,?)";

           preparedStatement = connection.prepareStatement(sql);
           preparedStatement.setString(1, "ATGUIGU");
           preparedStatement.setString(2, "simpleit@163.com");
           preparedStatement.setDate(3,
                   new Date(new java.util.Date().getTime()));

           preparedStatement.executeUpdate();
       } catch (Exception e) {
           e.printStackTrace();
       } finally {
           JDBCTools.releaseDB(null, preparedStatement, connection);
       }
   }

二、

   /**
   * SQL 注入.
   */
   @Test
   public void testSQLInjection() {
       String username = "a' OR PASSWORD = ";
       String password = " OR '1'='1";

       String sql = "SELECT * FROM users WHERE username = '" + username
               + "' AND " + "password = '" + password + "'";

       System.out.println(sql);

       Connection connection = null;
       Statement statement = null;
       ResultSet resultSet = null;

       try {
           connection = JDBCTools.getConnection();
           statement = connection.createStatement();
           resultSet = statement.executeQuery(sql);

           if (resultSet.next()) {
               System.out.println("登录成功!");
           } else {
               System.out.println("用户名和密码不匹配或用户名不存在. ");
           }

       } catch (Exception e) {
           e.printStackTrace();
       } finally {
           JDBCTools.releaseDB(resultSet, statement, connection);
       }
   }