数据库技术:简单聊一聊SQL注入及防止SQL注入

package jdbctest;    import java.sql.connection;  import java.sql.drivermanager;  import java.sql.resultset;  import java.sql.statement;  import java.util.scanner;    /*   * 用户登录   */  public class demo4 {        public static void main(string[] args) throws exception {          // 1.加载驱动          class.forname("com.mysql.jdbc.driver");          // 2.创建连接          string url = "jdbc:mysql:///test";          string username = "root";          string password = "1234";          connection cOnnection= drivermanager.getconnection(url, username, password);          // 接收用户名密码          scanner sc = new scanner(system.in);          string name = sc.next();          string pass = sc.next();// 3.sql语句          string sql = "select * from user where name='" + name + "' and pass ='" + pass + "'";          // system.out.println(sql);          // 4.获取sql对象statement          statement statement = connection.createstatement();          // 5.执行sql语句          resultset rs = statement.executequery(sql);                  // 6.登录          if (rs.next()) {              system.out.println("登录成功");          } else {              system.out.println("登录失败");          }          // 7.释放资源          statement.close();          connection.close();      }  }

        string sql = "select * from user where name='" + name + "' and pass ='" + pass + "'";  

public list orderlist(string studentid){      string sql = "select id,course_id,student_id,status from course where student_id = ?";      return jdbctemplate.query(sql,new object[]{studentid},new beanpropertyrowmapper(course.class));  }  

@component  public class sqlinjectionfilter implements filter {      @override      public void dofilter(servletrequest servletrequest, servletresponse servletresponse, filterchain chain) throws ioexception, servletexception {          httpservletrequest req=(httpservletrequest)servletrequest;          httpservletrequest res=(httpservletrequest)servletresponse;          //获得所有请求参数名          enumeration params = req.getparameternames();          string sql = "";          while (params.hasmoreelements()) {              // 得到参数名              string name = params.nextelement().tostring();              // 得到参数对应值              string[] value = req.getparametervalues(name);              for (int i = 0; i = 0) {                  return true;              }          }          return false;      }  }