JDBC代码的优化

JDBC代码简化以及PreparedStatement和Statement接口

1. 抽取
2. JDBC的Bug
   
   sql语句可以拼接导致登录功能中如果用户名或者密码中出现'or'2'='2则一定可以登录的bug，Statement有sql注入的危害
   
   所以有子类PreparedStatement继承Statement
   
   

Statement 和 PreparedStatement之间的关系和区别.来自：https://blog.csdn.net/suwu150/article/details/52745055

    关系：PreparedStatement继承自Statement,都是接口

    区别：PreparedStatement可以使用占位符，是预编译的，批处理比Statement效率高    

详解：

1、PreparedStatement：表示预编译的 SQL 语句的对象。

   接口：public interface PreparedStatement extends Statement之间的继承关系

   SQL 语句被预编译并存储在 PreparedStatement 对象中。然后可以使用此对象多次高效地执行该语句。

   注：用于设置 IN 参数值的设置方法（setShort、setString 等等）必须指定与输入参数的已定义 SQL 类型兼容的类型。例如，如果 IN 参数具有 SQL 类型 INTEGER，那么应该使用 setInt 方法，问号的位置也是应该注意的，因为第一个问好的位置为1，第二个问号的位置为2.以此类推。 如果需要任意参数类型转换，使用 setObject 方法时应该将目标 SQL 类型作为其参数。

BaseDao类 增删改抽取到父类中

1. 7个属性
2. 三个方法

• 得到Connection对象方法
• 增删改的通用方法
• 关闭方法

除了主函数有输出，其他地方不要有输出

一张表对应一张操作类和一个实体类（实体类放到bean包下）

命名：emp（表）------>EmpDao（操作类）------>Emp（实体类）

类------表名

属性------字段

对象------一条记录

练习：emp表完成增删改查,根据ID查，且使用basedao

package com.alibaba.wlq.dao;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
public class BaseDao {
    protected String driver = "com.mysql.jdbc.Driver";
    protected String url = "jdbc:mysql://localhost:3306/emp";
    protected String user = "root";
    protected String password = "123456";
    protected Connection conn = null;
    protected PreparedStatement ps = null;
    protected ResultSet rs = null;
    public void getConn() throws Exception{
        Class.forName(driver);
        conn = DriverManager.getConnection(url,user,password);
    }
    public void closeAll() {
        if(rs!=null) {
           try {
               rs.close();
           } catch (SQLException e) {
               e.printStackTrace();
           }
        }
        if(conn!=null) {
           try {
               conn.close();
           } catch (SQLException e) {
               e.printStackTrace();
           }
        }
        if(ps!=null) {
           try {
               ps.close();
           } catch (SQLException e) {
               e.printStackTrace();
           }
        }
    }
    public void edit(String sql,Object...params) {
        try {
           getConn();
           ps = conn.prepareStatement(sql);
           for(int i=0;i<params.length;i++) {
               ps.setObject(i+1, params[i]);
           }
           int <u>a</u> = ps.executeUpdate();
        } catch (SQLException e) {
           e.printStackTrace();
        } catch (Exception e) {
           e.printStackTrace();
        } finally {
           closeAll();
        }
    }
}

package com.alibaba.wlq.dao;
import java.sql.SQLException;
import java.util.ArrayList;
import java.util.Date;
import java.util.List;
import com.alibaba.wlq.bean.Emp;
public class EmpDao extends BaseDao{
    /**
     * 添加员工信息
     * @param empno    员工编号
     * @param ename    员工姓名
     * @param job  员工职位
     * @param mgr  员工上司
     * @param sal  员工的薪资
     * @param comm 员工的奖金
     * @param deptno   员工所在部门
     */
    public void add(int empno,String ename,String job,int mgr,double sal,double comm,int deptno) {
        String sql = "insert into emp values(?,?,?,?,now(),?,?,?)";
        edit(sql,empno,ename,job,mgr,sal,comm,deptno);
    }
    /**
     * 输入员工编号删除相应的员工信息
     * @param empno
     */
    public void delete(int empno) {
        String sql = "delete from emp where empno = ?";
        edit(sql,empno);
    }
    /**
     * 输入员工编号来修改相对应员工的信息
     * @param empno 员工编号
     * @param ename    员工姓名
     * @param job  员工职位
     * @param mgr  员工领导编号
     * @param sal  员工薪资    
     * @param comm 员工奖金
     * @param depnot   员工所在部门编号
     */
    public void update(int empno,String ename,String job,int mgr,double sal,double comm,int depnot) {
        String sql = "update emp set ename = ?,job = ?,mgr = ?,sal = ?,comm = ?,deptno = ? where empno =?";
        edit(sql,ename,job,mgr,sal,comm,depnot,empno);
    }
    /**
     * 根据员工编号查询员工姓名
     * @param empno 员工编号
     * @return
     */
    public Emp select(int empno) {
        Emp emp = null;
        try {
           getConn();
           String sql = "select * from emp where empno = ?";
           ps = conn.prepareStatement(sql);
           ps.setInt(1, empno);
           rs = ps.executeQuery();
           while(rs.next()) {
               int empno2 = rs.getInt("empno");
               String ename = rs.getString("ename");
               String job = rs.getString("job");
               int mgr = rs.getInt("mgr");
               Date hiredate = rs.getDate("hiredate");
               int sal = rs.getInt("sal");
               int comm = rs.getInt("comm");
               int dept = rs.getInt("deptno"); //数据库中获取字段的值
               //给对象的属性赋值
               emp=new Emp();
               emp.setEmpno(empno2);
               emp.setEname(ename);
               emp.setComm(comm);
               emp.setDeptno(dept);
               emp.setHiredate(hiredate);
               emp.setJob(job);
               emp.setMgr(mgr);
               emp.setSal(sal);
           }
        } catch (SQLException e) {
           e.printStackTrace();
        } catch (Exception e) {
           e.printStackTrace();
        }
        return emp;
    }
    /**
     * 查询所有员工的信息
     * @param sql
     * @param empno
     * @return
     */
    public List<Emp> selectAll(){
        List<Emp> list = new ArrayList<>();
        try {
           getConn();
           String sql = "Select * from emp";
           ps = conn.prepareStatement(sql);
           rs = ps.executeQuery();
           while(rs.next()) {
               Emp emp = new Emp();
               emp.setDeptno(rs.getInt("empno"));
               emp.setEname(rs.getString("ename"));
               emp.setJob(rs.getString("job"));
               emp.setHiredate(rs.getDate("hiredate"));
               emp.setMgr(rs.getInt("mgr"));
               emp.setSal(rs.getDouble("sal"));
               emp.setComm(rs.getDouble("comm"));
               list.add(emp);
           }
        } catch (SQLException e) {
           e.printStackTrace();
        } catch (Exception e) {
           e.printStackTrace();
        }finally {
           closeAll();
        }
        return list;
    }
}

package com.alibaba.wlq.dao;
import java.util.List;
import com.alibaba.wlq.bean.Emp;
public class test {
    public static void main(String[] args) {
        EmpDao emp = new EmpDao();
        //emp.add(10016,"佩奇", "singer",
1001, 10000.0, 10000.0, 10);
        //emp.delete(10016);
        //emp.update(1015,"刘亦菲","演员",
1001, 10000.0, 50000.0, 10);
//      <u>Emp</u> e = emp.select(1001);
//      if(e==null) {
//         System.out.println("该员工编号不存在");
//      }else {
//         System.out.println(e.getEname());
//      }
        List<Emp> list = emp.selectAll();
        for(Emp e:list) {
           if(e==null) {
               System.out.println("该编号的员工不存在");
           }
           else {
               System.out.println(e.getEname());
           }
        }
    }
}

package com.alibaba.wlq.bean;
import java.util.Date;
public class Emp {
    private int empno;
    private String ename;
    private String job;
    private int mgr;
    private Date hiredate;
    private double sal;
    private double comm;
    private int deptno;
    public Emp(int empno, String ename, String job, int mgr, Date hiredate, double sal, double comm, int deptno) {
        super();
        this.empno = empno;
        this.ename = ename;
        this.job = job;
        this.mgr = mgr;
        this.hiredate = hiredate;
        this.sal = sal;
        this.comm = comm;
        this.deptno = deptno;
    }
    public Emp() {
    }
    public int getEmpno() {
        return empno;
    }
    public void setEmpno(int empno) {
        this.empno = empno;
    }
    public String getEname() {
        return ename;
    }
    public void setEname(String ename) {
        this.ename = ename;
    }
    public String getJob() {
        return job;
    }
    public void setJob(String job) {
        this.job = job;
    }
    public int getMgr() {
        return mgr;
    }
    public void setMgr(int mgr) {
        this.mgr = mgr;
    }
    public Date getHiredate() {
        return hiredate;
    }
    public void setHiredate(Date hiredate) {
        this.hiredate = hiredate;
    }
    public double getSal() {
        return sal;
    }
    public void setSal(double sal) {
        this.sal = sal;
    }
    public double getComm() {
        return comm;
    }
    public void setComm(double comm) {
        this.comm = comm;
    }
    public int getDeptno() {
        return deptno;
    }
    public void setDeptno(int deptno) {
        this.deptno = deptno;
    }
}