借助预编译防止sql注入攻击

可重用的sql操作类

 public ResultSet doQuery(String sql,Object[] params){
         ResultSet rs = null;
         conn = this.getConnection();
         try{
             PreparedStatement pstmt = conn.prepareStatement(sql);
             for(int i =0;i<params.length;i++){
                 pstmt.setObject(i+1, params[i]);
             }
             rs = pstmt.executeQuery();
         }catch(Exception e){
             e.printStackTrace();
         }
         return rs;
     }

 public int doUpdate(String sql,Object[] params){
         int res = 0;
         conn  = this.getConnection();
         try{
             PreparedStatement pstmt = conn.prepareStatement(sql);
             for(int i=0;i<params.length;i++){
                 pstmt.setObject(i+1, params[i]);
             }
             res = pstmt.executeUpdate();
         }catch(Exception e){
             e.printStackTrace();
         }
         return res;
     }

 public List<Object>  doQueryList(String sql,Object []params){
         List<Object> list = new ArrayList<Object>();
         ResultSet rs = this.doQuery(sql, params);
         try{
             ResultSetMetaData rsmd  = rs.getMetaData();
             int columnLength = rsmd.getColumnCount();
             while(rs.next()){
                 Map<String,Object> map = new HashMap<String,Object>();
                 for(int i = 1;i<=columnLength;i++){
                     map.put(rsmd.getColumnLabel(i), rs.getObject(i));
                 }
                 list.add(map);
             }
         }catch(Exception e){
             e.printStackTrace();
         }
         return list;
     }

查询所有信息的jsp关键代码如下

 <%
     DBCon dbc = new DBCon();
     String sql  = "select * from schema.admin";
     List list = dbc.doQueryList(sql, new Object[]{});

     %>
     <table border="1">
     <%for(int i =0;i<list.size();i++){
         Map<String,Object> map = (Map<String,Object>)list.get(i);
         %>
         <tr>
             <td><%=map.get("id") %></td>
             <td><%=map.get("username") %></td>
             <td><%=map.get("password") %></td>
             <td><a href="do_delete.jsp?id=<%=map.get("id")%>">删除</a></td>
             <td><a href="do_edit.jsp?id=<%=map.get("id")%>">编辑</a></td>
         </tr>
     <%}
     dbc.close();
     %>
     </table>
     <a href="addAdmin.jsp">添加用户</a>

更新、删除登操作同理，不再列出。