總結 PreparedStatement解決sql注入問題
：sql中使用？做占位符
2.得到PreparedStatement對象
PreparedStatement pst=conn.prepareStatement(String sql);
pst.setString(1,"aaa");//設置 第一個?的占位符賦值
pst.setString(2,"bbb");
// 查找用戶 使用PreparedStatement 解決了 sql注入問題
public
User findUser(User user) {
String sql =
"select * from user where username='?' and password='?'"
;
Connection conn =
null
;
PreparedStatement pst =
null
;
ResultSet rs =
null
;
try
{
conn = jdbcUtils. getConnection();
pst = conn.prepareStatement(sql);
pst.setString(1, user.getUsername());
pst.setString(2, user.getPassword());
rs = pst.executeQuery();
if
(rs.next()) {
User u =
new
User();
u.setId(rs.getInt(
"id"
));
u.setUsername(rs.getString(
"username"
));
u.setPassword(rs.getString(
"password"
));
u.setEmail(rs.getString(
"email"
));
return
u;
}
}
catch
(Exception e) {
//
TODO
Auto-generated catch block
e.printStackTrace();
}
return
null
;
}