SQL注入漏洞的解决PreparedStetament

JDBCUtil 工具集

package com.imooc.jdbc.utils;

import java.io.IOException;
import java.io.InputStream;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
import java.util.Properties;

public class JDBCUtil {
    
    private static final String CLASSLOAD;
    private static final String MYSQLURL;
    private static final String USERNAME;
    private static final String PASSWORD;
    
    
    static {
        //使用properties来加载类配置文件
        //先实例化properties对象
        
        Properties p = new Properties();
        //使用class.getClassLoader()所得到的java.lang.ClassLoader的
        //getResourceAsStream()方法
        //getResourceAsStream(name)方法的参数必须是包路径+文件名+.后缀
        //否则会报空指针异常
        
        InputStream dataLoad = JDBCUtil.class.getClassLoader().getResourceAsStream("mysql.properties");
        try {
            p.load(dataLoad);
            
            
        } catch (IOException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }
        //从properties文件中提取配置参数
        CLASSLOAD = p.getProperty("classLoad").trim();
        MYSQLURL = p.getProperty("MYSQLURL").trim();
        USERNAME = p.getProperty("USERNAME").trim();
        PASSWORD = p.getProperty("passWord").trim();
        
        System.out.println(CLASSLOAD);
        System.out.println(MYSQLURL);
        System.out.println(USERNAME);
        System.out.println(PASSWORD);
    }
    
    public static void loadClass() throws ClassNotFoundException {
        Class.forName(CLASSLOAD);
    }
    
    
    public static Connection getConnection() throws ClassNotFoundException, SQLException {
        loadClass();
        Connection conn = DriverManager.getConnection(MYSQLURL, USERNAME,PASSWORD);
        return conn;
    }
    
    /**
     * 数据重载解决用户自己写入
     * @param CLASSLOAD  驱动导入
     * @param MYSQLURL   数据连接url和数据名
     * @param USERNAME   用户名
     * @param PASSWORD   密码
     * @return
     * @throws ClassNotFoundException
     * @throws SQLException
     */
    
//    public static Connection getConnection(
//            String CLASSLOAD,String MYSQLURL,String USERNAME, String PASSWORD
//            ) throws ClassNotFoundException, SQLException {
//        
//        Class.forName(CLASSLOAD);
//        Connection conn = DriverManager.getConnection(MYSQLURL, USERNAME, PASSWORD);
//        return conn;
//        
//    }
    
    
    public static void release(Connection conn,Statement stmt) {
        if(stmt != null) {
            try {
                stmt.close();
            } catch (SQLException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
            
            stmt = null;
        }
        
        if(conn != null) {
            try {
                conn.close();
            } catch (SQLException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
            conn = null;
        }
    }
    
    public static void release(Connection conn,Statement stmt,ResultSet resultSet) {
        if(stmt != null) {
            try {
                stmt.close();
            } catch (SQLException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
            
            stmt = null;
        }
        
        if(conn != null) {
            try {
                conn.close();
            } catch (SQLException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
            conn = null;
        }
        
        if(resultSet != null) {
            try {
                resultSet.close();
            } catch (SQLException e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
        }
    }
    
}

PreparedStetament 的使用：

　　　　　　　　　　保存数据：

　　　　　　　　　　　　

    /**
     * 学习PreparedStatement的数据保存
     */
    public void insert() {
        Connection conn = null;
        PreparedStatement pstmt = null;
        boolean flag = false;
        
        try {
            //连接数据库
            conn = JDBCUtil.getConnection();
            //编写插入的sql数据
            String sql = "insert emp(username,age,sex,addr,depId) values(?,?,?,?,?)";
            //创建执行sql的对象
            pstmt = conn.prepareStatement(sql);
            
            pstmt.setString(1, "无上");
            pstmt.setInt(2, 26);
            pstmt.setString(3, "女");
            pstmt.setString(4, "香港");
            pstmt.setInt(5, 2);
            flag = pstmt.execute();
            
            if(flag) {
                System.out.print("数据添加成功");
            }
            
        } catch (ClassNotFoundException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (SQLException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }finally {
            //释放资源
            JDBCUtil.release(conn, pstmt);
        }
        
    }

修改数据

　　

    @Test
    /**
     * 修改数据
     */
    public void update() {
        Connection conn = null;
        PreparedStatement pstmt = null;
        
        
        try {
            //连接数据
            conn = JDBCUtil.getConnection();
            //编写sql
            String sql = "update emp set username=?,sex=? where id=?";
            //预处理sql
            pstmt = conn.prepareStatement(sql);
            
            //设置参数
            pstmt.setString(1, "小天");
            pstmt.setString(2, "男");
            pstmt.setInt(3, 7);
            
            //提交数据
            int num = pstmt.executeUpdate();
            if(num > 0) {
                System.out.println("数据修改成功");
            }
            
        } catch (ClassNotFoundException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } catch (SQLException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        } finally {
            //释放资源
            JDBCUtil.release(conn, pstmt);
        }
    }

查询数据

　　

    @Test
    /**
     * 查询一条数据
     */
    public void first() {
        Connection conn = null;
        PreparedStatement pstmt = null;
        ResultSet rs = null;
        try {
            //连接数据
            conn = JDBCUtil.getConnection();
            //编写
            String sql = "select id,username from emp where id=?";
            //预编译
            pstmt = conn.prepareStatement(sql);
            //设置参数
            pstmt.setInt(1, 7);
            //查询结果集
            rs = pstmt.executeQuery();
            if(rs.next()) {
                System.out.print(rs.getInt("id")+"----"+rs.getString("username"));
            }
            
        } catch (ClassNotFoundException | SQLException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }finally {
            JDBCUtil.release(conn, pstmt, rs);
        }
    }