JDBC模拟登陆及SQL语句防注入问题

实现模拟登陆效果：基于表Tencent

 package boom;

 import java.sql.Connection;
 import java.sql.DriverManager;
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.sql.Statement;
 import java.util.Date;
 import java.util.Scanner;

 /**
  * 模拟登陆
  *
  * @author Administrator
  *
  */
 public class JdbcLogin {
     public static void main(String[] args) {
         // 接收控制台信息
         Scanner scanner = new Scanner(System.in);
         // 提示语句
         System.out.println("请输入用户名：");
         String name = scanner.next();
         System.out.println("请输入密码：");
         String pwd = scanner.next();

         // 声明参数
         String driver = "oracle.jdbc.driver.OracleDriver";
         String url = "jdbc:oracle:thin:@localhost:1521:XE";
         String userName = "scott";
         String userPwd = "tiger";

         // 声明连接,初始化为空
         Connection connection = null;
         Statement statement = null;
         ResultSet resultSet = null;

         try {
             // 1.加载驱动
             Class.forName(driver);
             // 2.创建连接
             connection = DriverManager.getConnection(url, userName, userPwd);
             // 3.创建SQL命令发送器
             statement = connection.createStatement();
             // 4.发送SQL获取结果
             // 查询表里的对应数据源
             String sql = "select * from Tencent where uname = '"+name+"' and upwd = '"+pwd+"' ";
             System.out.println("HelloJdbcLogin.main(sql):"+sql);
             resultSet = statement.executeQuery(sql);
             //5:处理结果--判断是否有这个用户
             if(resultSet.next()){
                 System.out.println("HelloJdbcLogin.main(登陆成功)");
             }else{
                 System.out.println("HelloJdbcLogin.main(登陆失败)");
             }

         } catch (ClassNotFoundException e) {
             // TODO Auto-generated catch block
             e.printStackTrace();
         } catch (SQLException e) {
             // TODO Auto-generated catch block
             e.printStackTrace();
         } finally {
             // 6.关闭资源 【先开后关】
             try {
                 if (resultSet != null) {
                     resultSet.close();
                 }
             } catch (SQLException e) {
                 // TODO Auto-generated catch block
                 e.printStackTrace();
             }
             try {
                 if (statement != null) {
                     statement.close();
                 }
             } catch (SQLException e) {
                 // TODO Auto-generated catch block
                 e.printStackTrace();
             }
             try {
                 if (connection != null) {
                     connection.close();
                 }
             } catch (SQLException e) {
                 // TODO Auto-generated catch block
                 e.printStackTrace();
             }
         }
     }

 }

效果：

--请输入用户名：
迪丽热巴
--请输入密码：
1213456
--HelloJdbcLogin.main(sql):select * from Tencent where uname = '迪丽热巴' and upwd = '1213456'
HelloJdbcLogin.main(登陆成功)
----------------------------------------------------------------------------------------------
--请输入用户名：
迪丽热巴
--请输入密码：
12346
--HelloJdbcLogin.main(sql):select * from Tencent where uname = '迪丽热巴' and upwd = '12346'
HelloJdbcLogin.main(登陆失败)

执行代码用SQL注入拼接实现【SQL注入成功】

--请输入用户名：
小喜庆
--请输入密码：
664654'or'1'='1
--HelloJdbcLogin.main(sql):select * from Tencent where uname = '小喜庆' and upwd = '664654'or'1'='1'
HelloJdbcLogin.main(登陆成功)

为什么会注入成功？

Statement：不安全，拼接麻烦，阅读性差
PreparedStatement：安全，阅读性好，（执行效率高）
防止SQL注入风险：PreparedStatement

// 声明连接,初始化为空
Connection connection = null;
// 修改Statement ==> PreparedStatement
PreparedStatement ps = null;
ResultSet resultSet = null;

try {
	// 加载驱动
	Class.forName(driver);
	// 创建连接
	connection = DriverManager.getConnection(url, userName, userPwd);
	// 创建SQL命令发送器
	// ? 相当于占位符
	String sql = "select * from Tencent where uname = ? and upwd =?";
	ps=connection.prepareStatement(sql);
	// 赋值占位
	ps.setString(1, name);
	ps.setString(2, pwd);
	// 4.发送SQL获取结果
	System.out.println("HelloJdbcLogin.main(sql):"+sql);
	resultSet = ps.executeQuery();
	//5:处理结果--判断是否有这个用户
	if(resultSet.next()) {
		System.out.println("HelloJdbcLogin.main(登陆成功)");
	} else {
		System.out.println("HelloJdbcLogin.main(登陆失败)");
	}

详细代码：

 package boom;

 import java.sql.Connection;
 import java.sql.DriverManager;
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
 import java.util.Scanner;

 public class JdbcLogin2 {
     public static void main(String[] args) {
         // 接收控制台信息
         Scanner scanner = new Scanner(System.in);
         // 提示语句
         System.out.println("请输入用户名：");
         String name = scanner.next();
         System.out.println("请输入密码：");
         String pwd = scanner.next();

         // 声明参数
         String driver = "oracle.jdbc.driver.OracleDriver";
         String url = "jdbc:oracle:thin:@localhost:1521:XE";
         String userName = "scott";
         String userPwd = "tiger";

         // 声明连接,初始化为空
         Connection connection = null;
         PreparedStatement ps = null;
         ResultSet resultSet = null;

         try {
             // 1.加载驱动
             Class.forName(driver);
             // 2.创建连接
             connection = DriverManager.getConnection(url, userName, userPwd);
             // 3.创建SQL命令发送器
             //?相当于占位符
             String sql = "select * from Tencent where uname = ? and upwd =?";
             ps=connection.prepareStatement(sql);
             // 赋值
             ps.setString(1, name);
             ps.setString(2, pwd);
             // 4.发送SQL获取结果
             System.out.println("HelloJdbcLogin.main(sql):"+sql);
             resultSet = ps.executeQuery();
             //5:处理结果--判断是否有这个用户
             if(resultSet.next()){
                 System.out.println("HelloJdbcLogin.main(登陆成功)");
             }else{
                 System.out.println("HelloJdbcLogin.main(登陆失败)");
             }

         } catch (ClassNotFoundException e) {
             // TODO Auto-generated catch block
             e.printStackTrace();
         } catch (SQLException e) {
             // TODO Auto-generated catch block
             e.printStackTrace();
         } finally {
             // 6.关闭资源 【先开后关】
             try {
                 if (resultSet != null) {
                     resultSet.close();
                 }
             } catch (SQLException e) {
                 // TODO Auto-generated catch block
                 e.printStackTrace();
             }
             try {
                 if (ps != null) {
                     ps.close();
                 }
             } catch (SQLException e) {
                 // TODO Auto-generated catch block
                 e.printStackTrace();
             }
             try {
                 if (connection != null) {
                     connection.close();
                 }
             } catch (SQLException e) {
                 // TODO Auto-generated catch block
                 e.printStackTrace();
             }
         }
     }

 }

【SQL注入失败】

--请输入用户名：
小喜庆
--请输入密码：
664654'or'1'='1
--HelloJdbcLogin.main(sql):select * from Tencent where uname = ? and upwd =?
HelloJdbcLogin.main(登陆失败)