单例模式,sql注入,序列

序列在前面写过有关的博客,也有过总结,但是今天在做一个JDBC操作数据库的相关内容时需要使用序列创建一个自增长的字段居然不会了,所以将序列写在本篇的前面

1,序列是一个保存数据连续的增长的一种方式;

序列的创建;

 CREATE SEQUENCE seq_pro
  2  INCREMENT BY 1 -- 每次加几个
  3  START WITH 1 -- 从1开始计数
  4  NOMAXVALUE -- 不设置最大值 (MAXVALUE 99999999)
  5  NOCYCLE -- 一直累加，不循环
  6  CACHE 10;

上述代码就创建好了一个序列,关键是怎么样了使用序列的问题

那个字段需要是连续的就创建序列来做 (seq_pro.nextval);

 insert into table_pro values(seq_pro.nextval,'佳','2');

2,单例模式;

简化JDBC对数据库的操作,优化ORACLE数据库,提高性能

思路:将程序的连接写在一个静态类中,程序只能连接一次数据库;返回一个静态的方法

package 单例模式;

import java.sql.Connection;
import java.sql.DriverManager;
public class ConnDB {
	private static Connection conn = null;

	private ConnDB() {

	}
	public static Connection getCon() {
		if (conn != null) {
			return conn;
		}
		try {
			Class.forName("oracle.jdbc.driver.OracleDriver");
			String url = "jdbc:oracle:thin:@127.0.0.1:1521:orcl";

			conn = DriverManager.getConnection(url, "scott", "tiger");
			return conn;
		} catch (Exception e) {
			e.printStackTrace();
			return null;
		}
	}

}

2,1jdbc与单例模式

查询;

	public void SalAndJOb4eName(String name) {
		try {
			Connection conn = ConnDB.getCon();
			Statement stm = conn.createStatement();
			String sql = "select sal,job from emp where ename='" + name + "'";
			System.out.println(sql);
			ResultSet rs = stm.executeQuery(sql);
			while (rs.next()) {
				Float sal = rs.getFloat(1);
				String job = rs.getString(2);
				System.out.println(sal + "" + job);
			}
		} catch (Exception ef) {
			ef.printStackTrace();
		}
	}

调用;创建主类

demo.SalAndJOb4eName("SMITH");

运行结果;

select sal,job from emp where ename='SMITH'
800.0CLERK

3,sql注入与预编译

public void SalAndJOb4eName(String name) {
		try {
			Connection conn = ConnDB.getCon();
			Statement stm = conn.createStatement();
			String sql = "select sal,job from emp where ename='" + name + "'";
			System.out.println(sql);
			ResultSet rs = stm.executeQuery(sql);
			while (rs.next()) {
				Float sal = rs.getFloat(1);
				String job = rs.getString(2);
				System.out.println(sal + "" + job);
			}
		} catch (Exception ef) {
			ef.printStackTrace();
		}
	}

调用;

demo.SalAndJOb4eName("1' or '1'='1");

运行结果;

select sal,job from emp where ename='1' or '1'='1'
800.0CLERK
1600.0SALESMAN
1250.0SALESMAN
2975.0MANAGER
1250.0SALESMAN
2850.0MANAGER
2450.0MANAGER
3000.0ANALYST
5000.0PRESIDENT
1500.0SALESMAN
1100.0CLERK
950.0CLERK
3000.0ANALYST
1300.0CLERK

3,1 预编译可以防止简单点的sql注入问题

思路:先将sql语句编译再赋值;

//预编译的时候要传入sql
psmt.setString(1, name);//赋值

//执行编译的时候不需要传入sql

	// 预编译
	public void SalAndJob4eName2(String name) {
       try{
    	   Connection conn = ConnDB.getCon();
    	   //创建sql语句
    	   String sql = "select sal,job from emp where ename=?";
    	   //预编译
    	   PreparedStatement psmt =  conn.prepareStatement(sql);
    	   //赋值
    	   psmt.setString(1, name);
    	   //执行编译
    	   ResultSet rs = psmt.executeQuery();
			while (rs.next()) {
				Float sal = rs.getFloat(1);
				String job = rs.getString(2);
				System.out.println(sal + "" + job);
			}
    	   
       }catch(Exception ef){
    	   ef.printStackTrace();
       }
	}

调用;

demo.SalAndJob4eName2("1' or '1'='1"); //没有结果
demo.SalAndJob4eName2("SMITH");//有一条

单例模式,sql注入,序列

猜你喜欢