String sql = "select * from user where username=‘"+username+"‘ and password=‘"+password+"‘";String sql = "select * from user where username=‘tom‘ and password=‘123‘";select * from user where username=‘jerry‘ and password=‘abc‘；//这种情况是不会有问题的//测试如果传入的是SQL语句的的一部分username:tom‘ or ‘1‘=‘1password:????????//这时候的SQL语句为一下这种情况select * from user where username=‘tom‘ or ‘1‘=‘1‘ and password=‘?????‘；//由于and的执行优先级大于Or 可以看作以下情况select * from user where username=‘tom‘ or (‘1‘=‘1‘ and password=‘?????‘)；//由于是or 或者的关系这时的SQL语句可以看作是这样的语句select * from user where username=‘tom‘；
package com.heima.login.client;import java.util.Scanner;import com.heima.login.bean.User;import com.heima.login.seriver.services;public class login {/*** @param args* @throws Exception*/public static void main(String[] args) throws Exception {// TODO Auto-generated method stub// 创建Scanner接收输入内容- Scanner sc= new Scanner(System.in);
System.out.println("请输入用户名");String username = sc.nextLine();System.out.println("请输入密码");String password = sc.nextLine();// 创建服务端对象使用登陆方法services s=new services();User user = s.login(username, password);if(user!=null){System.out.println(user);}else{System.out.println("用户名或密码错误！！！");}}}
package com.heima.login.seriver;import java.sql.Connection;import java.sql.PreparedStatement;import java.sql.ResultSet;import com.heima.Tools.JdbcConnection;import com.heima.login.bean.User;public class services {public User login(String username,String password) throws Exception{//新建user引用，默认值问nullUser u=null;//使用自定义数据库连接工具类进行数据库连接Connection conn=JdbcConnection.getConnection();//创建预编译数据库连接语句String sql = "select * from user where username=? and password=?";//创建PreparedStatement对象对数据库语句进行预编译PreparedStatement stem=conn.prepareStatement(sql);//设置预编译语句中的查询值stem.setString(1, username);stem.setString(2, password);//执行SQL语句ResultSet rs=stem.executeQuery();//如果有记录对User对象进行赋值if(rs.next()){u = new User();u.setAge(rs.getInt("age"));u.setDept(rs.getString("Dept"));u.setEmail(rs.getString("email"));u.setGender(rs.getString("gender"));u.setId(rs.getInt("id"));u.setPassword(rs.getString("password"));u.setRegistTime(rs.getDate("registTime"));u.setSalary(rs.getDouble("salary"));u.setUsername(rs.getString("username"));}//关闭数据库资源JdbcConnection.close(conn, stem, rs);return u;}}
package com.itheima.login.entity;public class User {private int id;private String username;private String password;private String email;public int getId() {return id;}public void setId(int id) {this.id = id;}public String getUsername() {return username;}public void setUsername(String username) {this.username = username;}public String getPassword() {return password;}public void setPassword(String password) {this.password = password;}public String getEmail() {return email;}public void setEmail(String email) {this.email = email;}@Overridepublic String toString() {return "User [id=" + id + ", username=" + username + ", password="+ password + ", email=" + email + "]";}}
原文：http://www.cnblogs.com/didixyy/p/32337dc30134b1f2fab1ba7939ded5c1.html