用java连接MySQL的准备工作
1.下载MySQL(了解MySQL的基本语法)
2.下载java的和MySQL的连接
3.在程序中加入2中下载的jar包
写java程序连接数据库的基本步骤：
1.注册（加载）相应数据库的驱动
Class.forName("com.mysql.jdbc.Driver");//选择注册驱动
2.建立java和数据库的连接
Connection con=DriverManager.getConnection(url,user,password);//建立和mysql数据库的连接
3.创建可以执行数据库语句的变量
Statement stmt = con.createStatement();
stmt.executeQuery(SqlRequest);//返回结果
4.存储结果的变量
ResultSet rs= stmt.executeQuery(SqlRequest);
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;
public class MysqlDemo1 {
public static void main(String[] args) {
selectAll();
//System.out.println(selectByUsernamePassword2("zs","123"));
//sql注入
//System.out.println(selectByUsernamePassword2("zs","12347'or'1'='1"));
}
public static void selectAll(){
// TODO Auto-generated method stub
Connection con=null;
Statement stmt=null;
ResultSet rs=null;
try {
Class.forName("com.mysql.jdbc.Driver");//选择注册驱动
String url="jdbc:mysql://localhost:3306/dy?useUnicode=true&characterEncoding=utf-8&useSSL=false";
String user="root";
String password="root";
con=DriverManager.getConnection(url,user,password);//建立和mysql数据库的连接
stmt = con.createStatement();
String SqlRequest = "select * from student";
rs= stmt.executeQuery(SqlRequest);
while(rs.next()){
System.out.println(rs.getString(1)+" "+rs.getString(2)+" "+rs.getString(3)+" "+rs.getString(4));//数值类型也可以用String类型进行获取输出
//System.out.println(rs.getString("id")+" "+rs.getString("stu_name")+" "+rs.getString("stu_sex")+" "+rs.getString("stu_score"));//这种输出格式也可以正确输出
}
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}finally{
try {
if(rs!=null)
rs.close();
} catch (SQLException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
try {
if(stmt!=null)
stmt.close();
} catch (SQLException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
try {
if(con!=null)
con.close();
} catch (SQLException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
}
public static boolean selectByUsernamePassword(String username,String password){//存在sql注入问题
Connection con=null;
Statement stmt=null;
ResultSet rs=null;
try {
Class.forName("com.mysql.jdbc.Driver");//注册对应的驱动
//url,"root","root"
String url= "jdbc:mysql://localhost:3306/dy?useUnicode=true&characterEncoding=utf-8&useSSL=false";
con = DriverManager.getConnection(url,"root","root");
stmt = con.createStatement();
String requestSql="select * from user where u_name='"+username+"'and u_password='"+password+"'";
rs = stmt.executeQuery(requestSql);
if(rs.next()){
return true;
}else{
return false;
}
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}finally{
try {
if(rs!=null)
rs.close();
} catch (SQLException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
try {
if(stmt!=null)
stmt.close();
} catch (SQLException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
try {
if(con!=null)
con.close();
} catch (SQLException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
return false;
}
public static boolean selectByUsernamePassword2(String username,String password){//解决sql注入
Connection con=null;
PreparedStatement stmt=null;
ResultSet rs=null;
try {
Class.forName("com.mysql.jdbc.Driver");//注册对应的驱动
//url,"root","root"
String url= "jdbc:mysql://localhost:3306/dy?useUnicode=true&characterEncoding=utf-8&useSSL=false";
con = DriverManager.getConnection(url,"root","root");
String RequestSql="select *from user where u_name=? and u_password=? ";
pstmt = con.prepareStatement(RequestSql);
pstmt.setString(1, username);
pstmt.setString(2,password);
rs = pstmt.executeQuery();
if(rs.next()){
return true;
}else{
return false;
}
} catch (Exception e) {
// TODO Auto-generated catch block
e.printStackTrace();
}finally{
try {
if(rs!=null)
rs.close();
} catch (SQLException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
try {
if(pstmt!=null)
pstmt.close();
} catch (SQLException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
try {
if(con!=null)
con.close();
} catch (SQLException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}
return false;
}
}
sql注入的产生：因为利用Statement的过程是我们自己进行字符串拼接（我们没有对密码进行特殊的处理），所以有些用户利用我们自己拼接字符串的漏洞就可以
例：System.out.println(selectByUsernamePassword2("zs","12347'or'1'='1"));将这句话和我们的字符串拼接之后输出的话是select * from user where u_name='zs'and u_password='12347'or'1'='1'
这句话在判断之后就会返回true
sql注入的解决：我们不进行字符串拼接，让系统的其他类帮我们完成类似的工作，我们舍弃之前的Statement转而用PreparedStatement，它是通过方法setString对用户的姓名和密码进行处理。