JDBC_mysql---防sql注入，存储图片

package PreparedStatement_sql注入;

import java.io.File;
import java.io.FileInputStream;
import java.io.InputStream;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.util.Scanner;

import org.junit.After;
import org.junit.Before;
import org.junit.Test;

public class PreparedStatement_sql {
    // 用？作为占位符号

    /**
     * 保存图片mysql中用longblob
     * @throws Exception
     */
@Test
public void saveImg() throws Exception{
    String sql = "insert into stud values(66,?,?)";
    PreparedStatement pst = con.prepareStatement(sql);
    //声明图片的信息
    File file = new File("./img/a.jpg");
    InputStream in = new FileInputStream(file);
    //设置参数到pst中
    pst.setString(1, "ss");
    pst.setBinaryStream(2,in);
    //执行
    pst.executeUpdate();
}

    /**
     * 防止sql注入
     *
     * @throws Exception
     */
    @Test
    public void regWithPre() throws Exception {

        Scanner sc = new Scanner(System.in);
        System.err.println("输入id ，name");
        String id = sc.nextLine();
        String name = sc.nextLine();
        String sql = "insert into stud values(?,?)";
        // preparedstatement pst 接收sql
        // 执行sql语句再设置参数
        PreparedStatement pst = con.prepareStatement(sql);
        // 编译好后设置参数
        // 设置值要从1开始
        pst.setString(1, id);
        pst.setString(2, name);
        pst.executeUpdate();

    }

    /**
     * 判断数据库里是否有值
     *
     * @throws Exception
     */
    @Test
    public void loginPst() throws Exception {
        Scanner sc = new Scanner(System.in);
        String nm = sc.nextLine();
        String id = sc.nextLine();
        String sql = "select * from stud where id=?  and name=?";
        PreparedStatement pst = con.prepareStatement(sql);
        pst.setString(1, id);
        pst.setString(2, nm);
        System.err.println(sql);
        ResultSet rs = pst.executeQuery();// 判断是否有值
        if (rs.next()) {
            System.err.println("你登录成功，你好欢迎你..");
        } else {
            System.err.println("你登录不成功。。。");
        }
    }

    @Before
    // 执行Test前执行
    public void getCon() throws Exception {
        Class.forName("com.mysql.jdbc.Driver");
        String url = "jdbc:mysql://127.0.0.1:3306/abc?useUnicode=true&characterEncoding=utf8";
        con = DriverManager.getConnection(url, "root", "1234");
        // con.close();
        // System.err.println(con);

    }

    @After
    // 执行Test后执行
    public void closeConn() throws Exception {
        if (con != null || !con.isClosed()) {

            con.close();
        }

    }

    private Connection con;

}