jdbc 07: 解决sql注入

jdbc连接mysql，解决sql注入问题

package com.examples.jdbc.o7_解决sql注入;

import java.sql.*;
import java.util.HashMap;
import java.util.Map;
import java.util.ResourceBundle;
import java.util.Scanner;

/*
    jdbc解决sql注入问题
 */
public class Test {
    public static void main(String[] args) {
        //用户登录
        Map<String, String> userInfo = userLogin();
        //验证登录信息
        boolean checkResult = loginCheck(userInfo);
        System.out.println(checkResult ? "登录成功" : "登录失败");
    }

    /**
     * 登录检测
     * @param userInfo 用户输入的登录信息
     * @return 登录检测结果，通过：成功登录， 未通过：登录失败
     */
    private static boolean loginCheck(Map<String, String> userInfo) {
        boolean checkResult = false;

        //资源绑定器绑定jdbc配置文件
        ResourceBundle resourceBundle = ResourceBundle.getBundle("config/jdbc");
        String driver = resourceBundle.getString("driver");
        String url = resourceBundle.getString("url");
        String userName = resourceBundle.getString("userName");
        String passWord = resourceBundle.getString("passWord");

        //3个资源对象
        Connection connection = null;
        PreparedStatement ps = null;    //预处理的数据库操作对象
        ResultSet rs = null;

        //jdbc数据库操作6步骤

        try {
            //1.
            Class.forName(driver);

            //2.
            connection = DriverManager.getConnection(url, userName, passWord);

            //3.获取 预处理数据库操作对象，同时编译sql语句框架
            String sql = "select * from tb_user where uname = ? and upasswd = ?";
            ps = connection.prepareStatement(sql);

            //向占位符处传值，用户输入的sql语句的关键词，不会被作为已编译的待执行的原本目标的sql语句的一部分
            ps.setString(1, userInfo.get("uname"));
            ps.setString(2, userInfo.get("upasswd"));

            //4.
            rs = ps.executeQuery();
            if(rs.next()){
                checkResult = true;
            }

        } catch (ClassNotFoundException | SQLException e) {
            e.printStackTrace();
        }finally {
            if(rs != null){
                try {
                    rs.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
            if(ps != null){
                try {
                    ps.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
            if(connection != null){
                try {
                    connection.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
        }
        return checkResult;
    }

    /**
     * 用户登录
     * @return 用户信息：用户名，密码
     */
    private static Map<String,String> userLogin() {
        Map<String, String> userInfo = new HashMap<>();

        Scanner scanner = new Scanner(System.in);
        System.out.println("用户名：");
        String userName = scanner.nextLine();
        System.out.println("密码：");
        String passWord = scanner.nextLine();

        userInfo.put("uname", userName);
        userInfo.put("upasswd", passWord);

        return userInfo;
    }
}