jdbc学习一半的代码

用java连接MySQL的准备工作

1.下载MySQL(了解MySQL的基本语法)

2.下载java的和MySQL的连接

3.在程序中加入2中下载的jar包

写java程序连接数据库的基本步骤：

1.注册（加载）相应数据库的驱动

Class.forName("com.mysql.jdbc.Driver");//选择注册驱动

2.建立java和数据库的连接

Connection con=DriverManager.getConnection(url,user,password);//建立和mysql数据库的连接

3.创建可以执行数据库语句的变量

Statement stmt = con.createStatement();

stmt.executeQuery(SqlRequest);//返回结果

4.存储结果的变量

ResultSet rs= stmt.executeQuery(SqlRequest);

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

public class MysqlDemo1 {

    public static void main(String[] args) {
        selectAll();
        //System.out.println(selectByUsernamePassword2("zs","123"));
        //sql注入
        //System.out.println(selectByUsernamePassword2("zs","12347'or'1'='1"));

    }
    public static void selectAll(){
    // TODO Auto-generated method stub
    Connection con=null;
    Statement stmt=null;
    ResultSet rs=null;
    try {
        Class.forName("com.mysql.jdbc.Driver");//选择注册驱动
        String url="jdbc:mysql://localhost:3306/dy?useUnicode=true&characterEncoding=utf-8&useSSL=false";
        String user="root";
        String password="root";
        con=DriverManager.getConnection(url,user,password);//建立和mysql数据库的连接
        stmt = con.createStatement();
        String SqlRequest = "select * from student";
        rs= stmt.executeQuery(SqlRequest);
        while(rs.next()){
        System.out.println(rs.getString(1)+" "+rs.getString(2)+" "+rs.getString(3)+" "+rs.getString(4));//数值类型也可以用String类型进行获取输出
//System.out.println(rs.getString("id")+" "+rs.getString("stu_name")+" "+rs.getString("stu_sex")+" "+rs.getString("stu_score"));//这种输出格式也可以正确输出
        }

    } catch (Exception e) {
        // TODO Auto-generated catch block
        e.printStackTrace();
    }finally{

            try {
                if(rs!=null)
                rs.close();
            } catch (SQLException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }

            try {
                if(stmt!=null)
                stmt.close();
            } catch (SQLException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }

            try {
                if(con!=null)
                con.close();
            } catch (SQLException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
    }        

}

    public static boolean selectByUsernamePassword(String username,String password){//存在sql注入问题

        Connection con=null;
        Statement stmt=null;
        ResultSet rs=null;

        try {
            Class.forName("com.mysql.jdbc.Driver");//注册对应的驱动
            //url,"root","root"
            String url= "jdbc:mysql://localhost:3306/dy?useUnicode=true&characterEncoding=utf-8&useSSL=false";
            con = DriverManager.getConnection(url,"root","root");

            stmt = con.createStatement();
            String requestSql="select * from user where u_name='"+username+"'and u_password='"+password+"'";
            rs = stmt.executeQuery(requestSql);
             if(rs.next()){
                 return true;
             }else{
                 return false;
             }

        } catch (Exception e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }finally{
            try {
                if(rs!=null)
                rs.close();
            } catch (SQLException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }

            try {
                if(stmt!=null)
                stmt.close();
            } catch (SQLException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }

            try {
                if(con!=null)
                con.close();
            } catch (SQLException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }

        }

        return false;

    }

    public static boolean selectByUsernamePassword2(String username,String password){//解决sql注入

        Connection con=null;
        PreparedStatement stmt=null;
        ResultSet rs=null;

        try {
            Class.forName("com.mysql.jdbc.Driver");//注册对应的驱动
            //url,"root","root"
            String url= "jdbc:mysql://localhost:3306/dy?useUnicode=true&characterEncoding=utf-8&useSSL=false";
            con = DriverManager.getConnection(url,"root","root");
            String RequestSql="select *from user where u_name=? and u_password=? ";
            pstmt = con.prepareStatement(RequestSql);

            pstmt.setString(1, username);
            pstmt.setString(2,password);
            rs = pstmt.executeQuery();
             if(rs.next()){
                 return true;
             }else{
                 return false;
             }

        } catch (Exception e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }finally{
            try {
                if(rs!=null)
                rs.close();
            } catch (SQLException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }

            try {
                if(pstmt!=null)
                pstmt.close();
            } catch (SQLException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }

            try {
                if(con!=null)
                con.close();
            } catch (SQLException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }

        }

        return false;

    }
}

sql注入的产生：因为利用Statement的过程是我们自己进行字符串拼接（我们没有对密码进行特殊的处理），所以有些用户利用我们自己拼接字符串的漏洞就可以

例：System.out.println(selectByUsernamePassword2("zs","12347'or'1'='1"));将这句话和我们的字符串拼接之后输出的话是select * from user where u_name='zs'and u_password='12347'or'1'='1'

这句话在判断之后就会返回true

sql注入的解决：我们不进行字符串拼接，让系统的其他类帮我们完成类似的工作，我们舍弃之前的Statement转而用PreparedStatement，它是通过方法setString对用户的姓名和密码进行处理。