JDBC中的PreparedStatement-防止SQL注入攻击

在JDBC对数据库进行操作的时候，SQL注入是一种常见的针对数据库的注入攻击方式。如下面的代码所演示，在我们的提交字段中掺入了SQL语句，会使得程序的登录校验失效：

package org.lyk.main;

import java.sql.Connection;

import java.sql.ResultSet;

import java.sql.SQLException;

import java.sql.Statement;

import java.util.ArrayList;

import java.util.List;

import org.apache.commons.dbcp2.BasicDataSource;

import org.omg.CORBA.PUBLIC_MEMBER;

import com.mysql.jdbc.DatabaseMetaData;

public class Main

{

public static String DBDRIVER = "com.mysql.jdbc.Driver";

public static String DB_URL = "jdbc:mysql://localhost:3306/mldn";

public static String USERNAME = "root";

public static String PASSWORD = "admin";

public static BasicDataSource bds = null;

public static void main(String[] args)

{

dbPoolInit();

System.out.println(verify("LIU YAN' -- ", "XXX"));

System.out.println("///Done~~~");

}

public static void dbPoolInit()

{

bds = new BasicDataSource();

bds.setDriverClassName(DBDRIVER);

bds.setUrl(DB_URL);

bds.setUsername(USERNAME);

bds.setPassword(PASSWORD);

}

public static boolean verify(String name, String password)

{

Connection conn = null;

Statement stmt = null;

ResultSet rs = null;

String sql = "SELECT COUNT(*) FROM user WHERE name='"+name+"' and password='"+password+"';";

System.out.println(sql);

boolean retVal = false;

try

{

conn = bds.getConnection();

stmt = conn.createStatement();

rs = stmt.executeQuery(sql);

if(rs.next() && rs.getInt(1) == 1)

{

retVal = true;

}

//System.out.println(rs.getInt(1));

} catch (SQLException e)

{

// TODO Auto-generated catch block

e.printStackTrace();

}

finally

{

try

{

if(conn != null )

conn.close();

if(stmt != null)

stmt.close();

if(rs != null)

rs.close();

}

catch(Exception exception)

{

//ignore all exceptions when closing...

}

}

return retVal;

}

}

为了解决这个问题，可以使用PreparedStatement来防止该类型的攻击。

其演示代码如下:

package org.lyk.main;

import java.sql.Connection;

import java.sql.PreparedStatement;

import java.sql.ResultSet;

import java.sql.SQLException;

import org.apache.commons.dbcp2.BasicDataSource;

public class Main

{

public static String DBDRIVER = "com.mysql.jdbc.Driver";

public static String DB_URL = "jdbc:mysql://localhost:3306/mldn";

public static String USERNAME = "root";

public static String PASSWORD = "admin";

public static BasicDataSource bds = null;

public static void main(String[] args)

{

dbPoolInit();

System.out.println(verify("LIU YAN' -- ", "XXX"));

System.out.println("///Done~~~");

}

public static void dbPoolInit()

{

bds = new BasicDataSource();

bds.setDriverClassName(DBDRIVER);

bds.setUrl(DB_URL);

bds.setUsername(USERNAME);

bds.setPassword(PASSWORD);

}

public static boolean verify(String name, String password)

{

Connection conn = null;

PreparedStatement stmt = null;

ResultSet rs = null;

String sql = "SELECT COUNT(*) FROM user WHERE name=? and password=? ;";

System.out.println(sql);

boolean retVal = false;

try

{

conn = bds.getConnection();

stmt = conn.prepareStatement(sql);

stmt.setString(1, name);

stmt.setString(2, password);

rs = stmt.executeQuery();

if(rs.next() && rs.getInt(1) == 1)

{

retVal = true;

}

//System.out.println(rs.getInt(1));

} catch (SQLException e)

{

// TODO Auto-generated catch block

e.printStackTrace();

}

finally

{

try

{

if(conn != null )

conn.close();

if(stmt != null)

stmt.close();

if(rs != null)

rs.close();

}

catch(Exception exception)

{

//ignore all exceptions when closing...

}

}

return retVal;

}

}