JDBC 增删改查代码 过滤查询语句

package test;

import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

public class CRUD {

/**
* @param args
*/
public static void main(String[] args) {
// TODO Auto-generated method stub
try {
create();
} catch (SQLException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}

static void create() throws SQLException {
Connection conn = null;
Statement st = null;

PreparedStatement ps =null;//这种statement可以用来过滤数据库查询语句，防止SQL注入
ResultSet rs = null;
try {
conn = JdbcUtils.getConnection();
//3，Statement用于“运送”sql语句和sql语句执行结果
String paraSql = “select * from user hwere name=?”;

//对于上面这种带？的sql可以用下面这个办法来获取statement

ps=conn.prepareStatement(sql)；//这种创建连接的办法虽然安全但是创建的时候比较耗时

String paraName = “’’ or 1 or ‘”;

ps.setString(1,paraName);

rs=ps.executeQuery();//这样是查询不到结果的，因为没有一个用户名叫做’’ or 1 or ‘

st = conn.createStatement();

String sql = "insert into user(name,birthday,money) values ('name1','1987-01-01','400')";

String sql1 = "update user set money=money+10";

String sql2 = "delete from user where id>5";
//4,执行sql
int count = st.executeUpdate(sql1);//增删改全用这个，返回值是受影响的行数
rs = st.executeQuery("select * from user");

while(rs.next()) {
//也可以使用列名，使用列号要从1开始
//for(int i = 1)
int i = rs.getMetaData().getColumnCount(); //获取列数
for(int j=1;j<=i;j++)
System.out.print(rs.getObject(j)+"\t");
System.out.println();
}
System.out.println(count);
} finally {
JdbcUtils.free(rs, st, conn);
}
}
}

package test;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

/* 简陋工具类 */
public final class JdbcUtils {
private static String url="jdbc:mysql://localhost:3306/world";
private static String user = "root";
private static String password="mysql";

static {
try {
Class.forName("com.mysql.jdbc.Driver");
} catch (ClassNotFoundException e) {
throw new ExceptionInInitializerError(e);
}

}

private JdbcUtils() {}

public static Connection getConnection() throws SQLException {
return DriverManager.getConnection(url,user,password);
}

public static void free(ResultSet rs,Statement st,Connection conn) {
try {
if (rs != null) {
rs.close();
}
}catch(SQLException e) {
e.printStackTrace();
}
finally {
try {
if (st != null) {
st.close();
}
} catch(SQLException e){
e.printStackTrace();
} finally {
if (conn != null)
try {
conn.close();
} catch (SQLException e) {
e.printStackTrace();
}
}
}
}
}