JDBC模拟登录及SQL语句防注入问题

实现模拟登录效果：基于表Tencent

 1 package boom;
 2 
 3 import java.sql.Connection;
 4 import java.sql.DriverManager;
 5 import java.sql.ResultSet;
 6 import java.sql.SQLException;
 7 import java.sql.Statement;
 8 import java.util.Date;
 9 import java.util.Scanner;
10 
11 /**
12  * 模拟登录
13  * 
14  * @author Administrator
15  *
16  */
17 public class JdbcLogin {
18     public static void main(String[] args) {
19         // 接收控制台信息
20         Scanner scanner = new Scanner(System.in);
21         // 提示语句
22         System.out.println("请输入用户名：");
23         String name = scanner.next();
24         System.out.println("请输入密码：");
25         String pwd = scanner.next();
26 
27         // 声明参数
28         String driver = "oracle.jdbc.driver.OracleDriver";
29         String url = "jdbc:oracle:thin:@localhost:1521:XE";
30         String userName = "scott";
31         String userPwd = "tiger";
32 
33         // 声明链接,初始化为空
34         Connection connection = null;
35         Statement statement = null;
36         ResultSet resultSet = null;
37 
38         try {
39             // 1.加载驱动
40             Class.forName(driver);
41             // 2.建立链接
42             connection = DriverManager.getConnection(url, userName, userPwd);
43             // 3.建立SQL命令发送器
44             statement = connection.createStatement();
45             // 4.发送SQL获取结果
46             // 查询表里的对应数据源
47             String sql = "select * from Tencent where uname = '"+name+"' and upwd = '"+pwd+"' ";
48             System.out.println("HelloJdbcLogin.main(sql):"+sql);
49             resultSet = statement.executeQuery(sql);
50             //5:处理结果--判断是否有这个用户
51             if(resultSet.next()){
52                 System.out.println("HelloJdbcLogin.main(登录成功)");
53             }else{
54                 System.out.println("HelloJdbcLogin.main(登录失败)");
55             }
56             
57         } catch (ClassNotFoundException e) {
58             // TODO Auto-generated catch block
59             e.printStackTrace();
60         } catch (SQLException e) {
61             // TODO Auto-generated catch block
62             e.printStackTrace();
63         } finally {
64             // 6.关闭资源 【先开后关】
65             try {
66                 if (resultSet != null) {
67                     resultSet.close();
68                 }
69             } catch (SQLException e) {
70                 // TODO Auto-generated catch block
71                 e.printStackTrace();
72             }
73             try {
74                 if (statement != null) {
75                     statement.close();
76                 }
77             } catch (SQLException e) {
78                 // TODO Auto-generated catch block
79                 e.printStackTrace();
80             }
81             try {
82                 if (connection != null) {
83                     connection.close();
84                 }
85             } catch (SQLException e) {
86                 // TODO Auto-generated catch block
87                 e.printStackTrace();
88             }
89         }
90     }
91 
92 }

View Code

效果：

--请输入用户名：
迪丽热巴
--请输入密码：
1213456
--HelloJdbcLogin.main(sql):select * from Tencent where uname = '迪丽热巴' and upwd = '1213456' 
HelloJdbcLogin.main(登录成功)
----------------------------------------------------------------------------------------------
--请输入用户名：
迪丽热巴
--请输入密码：
12346
--HelloJdbcLogin.main(sql):select * from Tencent where uname = '迪丽热巴' and upwd = '12346' 
HelloJdbcLogin.main(登录失败)

执行代码用SQL注入拼接实现【SQL注入成功】

--请输入用户名：
小喜庆
--请输入密码：
664654'or'1'='1
--HelloJdbcLogin.main(sql):select * from Tencent where uname = '小喜庆' and upwd = '664654'or'1'='1' 
HelloJdbcLogin.main(登录成功)

为何会注入成功？

Statement：不安全，拼接麻烦，阅读性差
PreparedStatement：安全，阅读性好，（执行效率高）
防止SQL注入风险：PreparedStatement

// 声明链接,初始化为空
Connection connection = null;
// 修改Statement ==> PreparedStatement
PreparedStatement ps = null;
ResultSet resultSet = null;

try {
	// 加载驱动
	Class.forName(driver);
	// 建立链接
	connection = DriverManager.getConnection(url, userName, userPwd);
	// 建立SQL命令发送器
	// ? 至关于占位符
	String sql = "select * from Tencent where uname = ? and upwd =?";
	ps=connection.prepareStatement(sql);
	// 赋值占位
	ps.setString(1, name);
	ps.setString(2, pwd);
	// 4.发送SQL获取结果
	System.out.println("HelloJdbcLogin.main(sql):"+sql);
	resultSet = ps.executeQuery();
	//5:处理结果--判断是否有这个用户
	if(resultSet.next()) {
		System.out.println("HelloJdbcLogin.main(登录成功)");
	} else {
		System.out.println("HelloJdbcLogin.main(登录失败)");
	}

详细代码：

 1 package boom;
 2 
 3 import java.sql.Connection;
 4 import java.sql.DriverManager;
 5 import java.sql.PreparedStatement;
 6 import java.sql.ResultSet;
 7 import java.sql.SQLException;
 8 import java.util.Scanner;
 9 
10 public class JdbcLogin2 {
11     public static void main(String[] args) {
12         // 接收控制台信息
13         Scanner scanner = new Scanner(System.in);
14         // 提示语句
15         System.out.println("请输入用户名：");
16         String name = scanner.next();
17         System.out.println("请输入密码：");
18         String pwd = scanner.next();
19 
20         // 声明参数
21         String driver = "oracle.jdbc.driver.OracleDriver";
22         String url = "jdbc:oracle:thin:@localhost:1521:XE";
23         String userName = "scott";
24         String userPwd = "tiger";
25 
26         // 声明链接,初始化为空
27         Connection connection = null;
28         PreparedStatement ps = null;
29         ResultSet resultSet = null;
30 
31         try {
32             // 1.加载驱动
33             Class.forName(driver);
34             // 2.建立链接
35             connection = DriverManager.getConnection(url, userName, userPwd);
36             // 3.建立SQL命令发送器
37             //?至关于占位符
38             String sql = "select * from Tencent where uname = ? and upwd =?";
39             ps=connection.prepareStatement(sql);
40             // 赋值
41             ps.setString(1, name);
42             ps.setString(2, pwd);
43             // 4.发送SQL获取结果
44             System.out.println("HelloJdbcLogin.main(sql):"+sql);
45             resultSet = ps.executeQuery();
46             //5:处理结果--判断是否有这个用户
47             if(resultSet.next()){
48                 System.out.println("HelloJdbcLogin.main(登录成功)");
49             }else{
50                 System.out.println("HelloJdbcLogin.main(登录失败)");
51             }
52             
53         } catch (ClassNotFoundException e) {
54             // TODO Auto-generated catch block
55             e.printStackTrace();
56         } catch (SQLException e) {
57             // TODO Auto-generated catch block
58             e.printStackTrace();
59         } finally {
60             // 6.关闭资源 【先开后关】
61             try {
62                 if (resultSet != null) {
63                     resultSet.close();
64                 }
65             } catch (SQLException e) {
66                 // TODO Auto-generated catch block
67                 e.printStackTrace();
68             }
69             try {
70                 if (ps != null) {
71                     ps.close();
72                 }
73             } catch (SQLException e) {
74                 // TODO Auto-generated catch block
75                 e.printStackTrace();
76             }
77             try {
78                 if (connection != null) {
79                     connection.close();
80                 }
81             } catch (SQLException e) {
82                 // TODO Auto-generated catch block
83                 e.printStackTrace();
84             }
85         }
86     }
87 
88 }

View Code

【SQL注入失败】

--请输入用户名：
小喜庆
--请输入密码：
664654'or'1'='1
--HelloJdbcLogin.main(sql):select * from Tencent where uname = ? and upwd =?
HelloJdbcLogin.main(登录失败)