SQL注入的定义以及解决

SQL注入的定义以及解决

什么是SQL注入
SQL 注入就是在用户输入的字符串中加入 SQL 语句&＃xff0c;如果在设计不良的程序中忽略了检查&＃xff0c;那么这些注入进去的 SQL 语句就会被数据库服务器误认为是正常的 SQL 语句而运行&＃xff0c;攻击者就可以执行计划外的命令或访问未被授权的数据。
说人话就是,程序把用户输入的遍历当作SQL语句的关键字而执行了。
下边给出一个简单的demo:

import java.sql.*;
import java.util.Scanner;import com.mysql.jdbc.Driver;public class SQL_insert {public void solve(){Scanner scanner&＃61;new Scanner(System.in);System.out.println("输入id:");String id&＃61; scanner.nextLine();System.out.println("输入密码:");String name&＃61;scanner.nextLine();Statement statement &＃61; null;Connection connection &＃61; null;ResultSet set &＃61; null;try {Driver driver &＃61; new Driver();DriverManager.registerDriver(driver);connection &＃61; DriverManager.getConnection("jdbc:mysql://localhost:3305/JAVA_LEARN", "root", "root");statement &＃61; connection.createStatement();String DQL &＃61; "select * from people where id&＃61;"&＃43;id&＃43;" and name&＃61;"&＃43;name;set &＃61; statement.executeQuery(DQL);if(set.next()) {System.out.println("登陆成功");}else {System.out.println("登陆失败");}} catch (SQLException e) {e.printStackTrace();} finally {if (statement !&＃61; null) {try {statement.close();} catch (SQLException e) {e.printStackTrace();}}if (connection !&＃61; null) {try {connection.close();} catch (SQLException e) {e.printStackTrace();}}if (set !&＃61; null) {try {set.close();} catch (SQLException e) {e.printStackTrace();}}}}public static void main(String[] args) {SQL_insert insert &＃61; new SQL_insert();insert.solve();}
}

这是一个简单的登陆检查程序,现在给他一个错误的输入:

显示登陆成功。
为什么会这样?
因为用户输入的密码是 123 or 1&＃61;‘1’
所以执行的SQL就是:

select * from people where id&＃61; 123 and name &＃61; 123 or 1&＃61;&＃39;1&＃39;


密码的一部分被当作关键字被编译进去了,所以无论怎么查都会有结果。
如何解决
只要用户输入的信息不参与SQL编译就解决了
只要预先编译SQL语句框架,然后再给SQL传值即可

故引入 PreparedStatement 预编译的数据库操作对象
解决后的demo

//用来解决SQL注入问题的类import com.mysql.jdbc.Driver;import java.sql.*;
import java.util.Scanner;public class SQL_insert_Solve {public void solve(){Scanner scanner&＃61;new Scanner(System.in);System.out.println("输入id:");String id&＃61; scanner.nextLine();System.out.println("输入密码:");String name&＃61;scanner.nextLine();PreparedStatement statement &＃61; null;Connection connection &＃61; null;ResultSet set &＃61; null;try {Driver driver &＃61; new Driver();DriverManager.registerDriver(driver);connection &＃61; DriverManager.getConnection("jdbc:mysql://localhost:3305/JAVA_LEARN", "root", "root");//获取预编译的数据库操作对象:statement &＃61; connection.prepareStatement("select * from people where id &＃61; ? and name &＃61; ?");statement.setString(1,id);statement.setString(2,name);set &＃61; statement.executeQuery();if(set.next()) {System.out.println("登陆成功");}else {System.out.println("登陆失败");}} catch (SQLException e) {e.printStackTrace();} finally {if (statement !&＃61; null) {try {statement.close();} catch (SQLException e) {e.printStackTrace();}}if (connection !&＃61; null) {try {connection.close();} catch (SQLException e) {e.printStackTrace();}}if (set !&＃61; null) {try {set.close();} catch (SQLException e) {e.printStackTrace();}}}}public static void main(String[] args) {SQL_insert insert &＃61; new SQL_insert();insert.solve();}
}