防止sql注入等的危险

2019独角兽企业重金招聘Python工程师标准>>>

@Test
public void testLogin2() throws Exception {
	Connection con = ConnUtils.getCon();
	
	Scanner sc = new Scanner(System.in);
	String name = sc.nextLine();
	String pwd = sc.nextLine();
	//使用？占位符，不能用串联字符串
	String sql ="select * from users where name=? and pwd=?";
	//执行sql语句使用

            PreparedStatement pst = con.prepareStatement(sql);
	pst.setString(1, name);
	pst.setString(2, pwd);
	System.err.println(sql);
	ResultSet rs = pst.executeQuery();
	if(rs.next()){
		System.err.println("登录成功");
	}else{
		System.err.println("用户名或是密码错误..");
	}

	pst.close();
	con.close();
}

转载于:https://my.oschina.net/dtz/blog/652628