java mysql sql注入_Java防SQL注入MySQL数据查询

/**

*

*/

package user.DAO;

import java.sql.*;

import user.entity.User;

/** *//**

* 用户数据访问层

* @author http://www.my400800.cn

*@version 1.0

*日期2010 01 12

*/

public class UserDAO {

/** *//**

* 根据用户名和密码查找用户,找到了返回 user 对象,否则返回 null

* @param(参量) user

*/

public findUserByUsernamePassword(User user){

// 1.注册驱动

try {

Class.forName("com.mysql.jdbc.Driver");

} catch (ClassNotFoundException e) {

// TODO Auto-generated catch block

e.printStackTrace();

}//mysql驱动

java.sql.Connection conn = null;

PreparedStatement pstmt = null;

ResultSet rs = null;

try {

//2.获取数据库的连接(接数据库)

conn = java.sql.DriverManager.getConnection(

"jdbc:mysql://localhost/stums?useUnicode=true&characterEncoding=GBK","root","admin");

//执行SQL

pstmt = conn.prepareStatement("select * from student where Sno =? and Password = ?");

//设置参数防止SQL注入

pstmt.setString(1, user.getUsername());

pstmt.setString(2, user.getPassword());

//获取数据集

rs = pstmt.executeQuery();

if(rs != null && rs.next()){

user.setId(rs.getInt("Sno"));

return user;

}

} catch (SQLException e) {

// TODO Auto-generated catch block

e.printStackTrace();

}finally{    //释放资源

try {

rs.close();     //关闭数据集

} catch (Exception e) {

// TODO Auto-generated catch block

e.printStackTrace();

}

try {

pstmt.close();    //关闭表连接

} catch (Exception e) {

// TODO Auto-generated catch block

e.printStackTrace();

}

try {

conn.close();    //关闭数据库连接

} catch (Exception e) {

// TODO Auto-generated catch block

e.printStackTrace();

}

}

return null;

}

}

分享到：

2011-01-12 14:35

浏览 1552

评论