JDBC-使用preparedstatement避免sql注入

使用preparedstatement代码

package jdbc;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.Scanner;
public class preparedstatement {

public static void main(String[] args) throws SQLException {
// TODO 自动生成的方法存根
String url = "jdbc:mysql://localhost:3306/login";
String user = "root";
String password = "981002";
String sql = "select * from register where user=? and password=?;";

Scanner scanner = new Scanner(System.in);
System.out.println("请输入用户名");
String in_username = scanner.nextLine();
System.out.println("请输入密码");
String in_password = scanner.nextLine();
scanner.close();
Connection connection = DriverManager.getConnection(url,user,password);
//预编译sql语句
PreparedStatement pre = connection.prepareStatement(sql);
System.out.println(pre);
pre.setString(1, in_username);
pre.setString(2, in_password);
System.out.println(pre);
ResultSet resultset = pre.executeQuery();
if(resultset.next())
{
System.out.println("登陆成功");
}
else {
System.out.println("登陆失败");
}
resultset.close();
pre.close();
connection.close();
}
}

正确运行

sql注入运行

可以看到，引号，自动添加了反斜杠，表示转义字符。这样就避免了sql注入问题。