sql注入

最新推荐文章于 2025-09-13 19:07:06 发布

weixin_33961829

最新推荐文章于 2025-09-13 19:07:06 发布

阅读量55

点赞数

CC 4.0 BY-SA版权

文章标签：数据库

原文链接：http://www.cnblogs.com/nangongyibin/p/10200572.html

sql注入(登录查询数据库)

通过一个登录案例模拟创建一个用户表用来模拟用户登录信息 create table login(id int,name varchar(20),pwd varchar(20));

insert into login values(1,’abc’,’123’); 
insert into login values(2,’abcd’,’1234’);

模拟登录

select * from login where name=’abc’ and pwd=’123’ 
select * from login where name=’abc’or’1==1’ and pwd=’123dhdhdhdhdhd’ 
select * from login where name= ‘abc\’or\’1==1’ and pwd= ‘123dhdhdhdhdhd’

代码实现:

    public static void loginIn(String name, String pwd) throws Exception {
        DriverManager.registerDriver(new Driver());
        Connection conn = DriverManager.getConnection("jdbc:mysql://**.***.**.***:3306/ngyb", "root", "123456");
        String sql = "select * from login where name = ? and pwd =?";
        PreparedStatement prepareStatement = conn.prepareStatement(sql);
        prepareStatement.setString(1, name);
        prepareStatement.setString(2, pwd);
        ResultSet resultSet = prepareStatement.executeQuery();
        if (resultSet.next()) {
            System.out.println("登录成功");
        } else {
            System.out.println("登录失败");
        }
        resultSet.close();
        prepareStatement.close();
        conn.close();
    }
}

转载于:https://www.cnblogs.com/nangongyibin/p/10200572.html