借助预编译防止sql注入攻击

可重用的sql操作类

public ResultSet doQuery(String sql,Object[] params){
        ResultSet rs = null;
        conn = this.getConnection();
        try{
            PreparedStatement pstmt = conn.prepareStatement(sql);
            for(int i =0;i<params.length;i++){
                pstmt.setObject(i+1, params[i]);
            }
            rs = pstmt.executeQuery();
        }catch(Exception e){
            e.printStackTrace();
        }
        return rs;
    }

public int doUpdate(String sql,Object[] params){
        int res = 0;
        conn  = this.getConnection();
        try{
            PreparedStatement pstmt = conn.prepareStatement(sql);
            for(int i=0;i<params.length;i++){
                pstmt.setObject(i+1, params[i]);
            }
            res = pstmt.executeUpdate();
        }catch(Exception e){
            e.printStackTrace();
        }
        return res;
    }

public List<Object>  doQueryList(String sql,Object []params){
        List<Object> list = new ArrayList<Object>();
        ResultSet rs = this.doQuery(sql, params);
        try{
            ResultSetMetaData rsmd  = rs.getMetaData();
            int columnLength = rsmd.getColumnCount();
            while(rs.next()){
                Map<String,Object> map = new HashMap<String,Object>();
                for(int i = 1;i<=columnLength;i++){
                    map.put(rsmd.getColumnLabel(i), rs.getObject(i));
                }
                list.add(map);
            }
        }catch(Exception e){ 
            e.printStackTrace();
        }
        return list;
    }

查询所有信息的jsp关键代码如下

<%
    DBCon dbc = new DBCon();
    String sql  = "select * from schema.admin";
    List list = dbc.doQueryList(sql, new Object[]{});
    
    %>
    <table border="1">
    <%for(int i =0;i<list.size();i++){
        Map<String,Object> map = (Map<String,Object>)list.get(i);
        %>
        <tr>
            <td><%=map.get("id") %></td>
            <td><%=map.get("username") %></td>
            <td><%=map.get("password") %></td>
            <td><a href="do_delete.jsp?id=<%=map.get("id")%>">删除</a></td>
            <td><a href="do_edit.jsp?id=<%=map.get("id")%>">编辑</a></td>
        </tr>
    <%}
    dbc.close();
    %>
    </table>
    <a href="addAdmin.jsp">添加用户</a>

更新、删除登操作同理，不再列出。