JDBC系列--解决简单的SQL注入问题

String sql = "select * from user where username = '"+username+"' and password = '"+password+"'";
 System.out.println(sql);

package cn.caq.jdbc;
import cn.caq.utils.JDBCutils;
import java.sql.*;
import java.util.Scanner;
/**
 * 需求：
 * 1.通过键盘录入用户名和密码
 * 2.判断用户是否登录成功
 */
public class JDBCDemo09 {
    public static void main(String[]args){
        //1.键盘录入，接受用户名和密码
        Scanner scanner = new Scanner(System.in);
        System.out.println("请输入username：");
        String username = scanner.nextLine();
        System.out.println("请输入password");
        String password = scanner.nextLine();
        //2.调用方法
//        JDBCDemo08 jdbcDemo08 = new JDBCDemo08();
//        boolean login = jdbcDemo08.login(username, password);
        boolean flag = new JDBCDemo09().login2(username, password);
        //3.判断结果，输出不同语句
        if (flag){
            System.out.println("Success!!!!!!");
        }else {
            System.out.println("username or passwd False!!!!!!!!");
        }
    }
    //登录方法
    public boolean login2(String username,String password){
        if (username == null || password == null){
            return false;
        }
        Connection conn = null;
        PreparedStatement pstmt = null;
        ResultSet rs = null;
        //1.连接数据库
        try {
            conn = JDBCutils.getConnection();
            //2.定义sql
            String sql = "select * from user where username = ? and password = ?";
            //3.获取执行sql的对象
            pstmt = conn.prepareStatement(sql);
            //给?赋值
            pstmt.setString(1,username);
            pstmt.setString(2,password);
            //4.执行sql语句
            rs = pstmt.executeQuery();
            //5.判断
            return rs.next();//有下一行返回true
        } catch (SQLException throwables) {
            throwables.printStackTrace();
        } finally {
            JDBCutils.close(rs,pstmt,conn);
        }
        return false;//如果出现异常返回false
    }
}