【大数据系列之JDBC】（五）：使用PrepareStatement防止SQL注入

public void testInsert() throws Exception {
        // 1.获取数据库连接
        Connection conn = JDBCUtils.getConnection();
        // 2.预编译SQL语句
        String sql = "insert into customers(name, email, birth) values(?, ?, ?)";
        // 3.获取PreparedStatement对象
        PreparedStatement ps = conn.prepareStatement(sql);
        // 4.填充占位符
        ps.setString(1, "哪吒");
        ps.setString(2, "nezha@gmail.com");
        SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd");
        Date date = sdf.parse("2022-12-22");
        ps.setDate(3, new java.sql.Date(date.getTime()));
        // 5.执行SQL语句
        ps.execute();
        // 6.关闭资源
        JDBCUtils.closeResource(conn, ps);
    }

public void testUpdate() {
        Connection conn = null;
        PreparedStatement ps = null;
        try {
            // 1.获取数据库连接
            conn = JDBCUtils.getConnection();
            // 2.预编译SQL语句
            String sql = "update customers set name = ? where id = ?";
            // 3.获取PreparedStatement对象
            ps = conn.prepareStatement(sql);
            // 4.填充占位符
            ps.setObject(1, "莫扎特");
            ps.setObject(2, 18);
            // 5.执行SQL语句
            ps.execute();
        } catch (Exception e) {
            e.printStackTrace();
        } finally {
            // 6.关闭资源
            JDBCUtils.closeResource(conn, ps);
        }
    }