鍩轟簬浠ヤ笅鐨勫師鍥?
涓.浠ｇ爜鐨勫彲璇繪у拰鍙淮鎶ゆ?
铏界劧鐢≒reparedStatement鏉ヤ唬鏇縎tatement浼氫嬌浠ｇ爜澶氬嚭鍑犺,浣嗚繖鏍風殑浠ｇ爜鏃犺浠庡彲璇繪ц繕鏄彲緇存姢鎬т笂鏉ヨ.閮芥瘮鐩存帴鐢⊿tatement鐨勪唬鐮侀珮寰堝妗ｆ:
stmt.executeUpdate("insert into tb_name (col1,col2,col2,col4) values ('"+var1+"','"+var2+"',"+var3+",'"+var4+"')");
perstmt = con.prepareStatement("insert into tb_name (col1,col2,col2,col4) values (?,?,?,?)");
perstmt.setString(1,var1);
perstmt.setString(2,var2);
perstmt.setString(3,var3);
perstmt.setString(4,var4);
perstmt.executeUpdate();
涓嶇敤鎴戝璇?瀵逛簬絎竴縐嶆柟娉?鍒鍏朵粬浜哄幓璇諱綘鐨勪唬鐮?灝辨槸浣犺嚜宸辮繃涓孌墊椂闂村啀鍘昏,閮戒細瑙夊緱浼ゅ績.
浜?PreparedStatement灝芥渶澶у彲鑳芥彁楂樻ц兘.
姣忎竴縐嶆暟鎹簱閮戒細灝芥渶澶у姫鍔涘棰勭紪璇戣鍙ユ彁渚涙渶澶х殑鎬ц兘浼樺寲.鍥犱負棰勭紪璇戣鍙ユ湁鍙兘琚噸澶嶈皟鐢?鎵浠ヨ鍙ュ湪琚獶B鐨勭紪璇戝櫒緙栬瘧鍚庣殑鎵ц浠ｇ爜琚紦瀛樹笅鏉?閭ｄ箞涓嬫璋冪敤鏃跺彧瑕佹槸鐩稿悓鐨勯緙栬瘧璇彞灝變笉闇瑕佺紪璇?鍙灝嗗弬鏁扮洿鎺ヤ紶鍏ョ紪璇戣繃鐨勮鍙ユ墽琛屼唬鐮佷腑(鐩稿綋浜庝竴涓兜鏁?灝變細寰楀埌鎵ц.榪欏茍涓嶆槸璇村彧鏈変竴涓?Connection涓嬈℃墽琛岀殑棰勭紪璇戣鍙ヨ緙撳瓨,鑰屾槸瀵逛簬鏁翠釜DB涓?鍙棰勭紪璇戠殑璇彞璇硶鍜岀紦瀛樹腑鍖歸厤.閭ｄ箞鍦ㄤ換浣曟椂鍊欏氨鍙互涓嶉渶瑕佸啀嬈＄紪璇戣屽彲浠ョ洿鎺ユ墽琛?鑰宻tatement鐨勮鍙ヤ腑,鍗充嬌鏄浉鍚屼竴鎿嶄綔,鑰岀敱浜庢瘡嬈℃搷浣滅殑鏁版嵁涓嶅悓鎵浠ヤ嬌鏁翠釜璇彞鐩稿尮閰嶇殑鏈轟細鏋佸皬,鍑犱箮涓嶅お鍙兘鍖歸厤.姣斿:
insert into tb_name (col1,col2) values ('11','22');
insert into tb_name (col1,col2) values ('11','23');
鍗充嬌鏄浉鍚屾搷浣滀絾鍥犱負鏁版嵁鍐呭涓嶄竴鏍?鎵浠ユ暣涓釜璇彞鏈韓涓嶈兘鍖歸厤,娌℃湁緙撳瓨璇彞鐨勬剰涔?浜嬪疄鏄病鏈夋暟鎹簱浼氬鏅氳鍙ョ紪璇戝悗鐨勬墽琛屼唬鐮佺紦瀛?榪欐牱姣忔墽琛屼竴嬈￠兘瑕佸浼犲叆鐨勮鍙ョ紪璇戜竴嬈?
褰撶劧騫朵笉鏄墍浠ラ緙栬瘧璇彞閮戒竴瀹氫細琚紦瀛?鏁版嵁搴撴湰韜細鐢ㄤ竴縐嶇瓥鐣?姣斿浣跨敤棰戝害絳夊洜绱犳潵鍐沖畾浠涔堟椂鍊欎笉鍐嶇紦瀛樺凡鏈夌殑棰勭紪璇戠粨鏋?浠ヤ繚瀛樻湁鏇村鐨勭┖闂村瓨鍌ㄦ柊鐨勯緙栬瘧璇彞.
涓?鏈閲嶈鐨勪竴鐐規槸鏋佸ぇ鍦版彁楂樹簡瀹夊叏鎬?
鍗充嬌鍒扮洰鍓嶄負姝?浠嶆湁涓浜涗漢榪炲熀鏈殑鎭朵箟SQL璇硶閮戒笉鐭ラ亾.
String sql = "select * from tb_name where name= '"+varname+"' and passwd='"+varpasswd+"'";
濡傛灉鎴戜滑鎶奫' or '1' = '1]浣滀負varpasswd浼犲叆榪涙潵.鐢ㄦ埛鍚嶉殢鎰?鐪嬬湅浼氭垚涓轟粈涔?
select * from tb_name = '闅忔剰' and passwd = '' or '1' = '1';
鍥犱負'1'='1'鑲畾鎴愮珛,鎵浠ュ彲浠ヤ換浣曢氳繃楠岃瘉.鏇存湁鐢氳?
鎶奫';drop table tb_name;]浣滀負varpasswd浼犲叆榪涙潵,鍒?
select * from tb_name = '闅忔剰' and passwd = '';drop table tb_name;鏈変簺鏁版嵁搴撴槸涓嶄細璁╀綘鎴愬姛鐨?浣嗕篃鏈夊緢澶氭暟鎹簱灝卞彲浠ヤ嬌榪欎簺璇彞寰楀埌鎵ц.
鑰屽鏋滀綘浣跨敤棰勭紪璇戣鍙?浣犱紶鍏ョ殑浠諱綍鍐呭灝變笉浼氬拰鍘熸潵鐨勮鍙ュ彂鐢熶換浣曞尮閰嶇殑鍏崇郴.(鍓嶆彁鏄暟鎹簱鏈韓鏀寔棰勭紪璇?浣嗕笂鍓嶅彲鑳芥病鏈変粈涔堟湇鍔＄鏁版嵁搴撲笉鏀寔緙栬瘧浜?鍙湁灝戞暟鐨勬闈㈡暟鎹簱,灝辨槸鐩存帴鏂囦歡璁塊棶鐨勯偅浜?鍙鍏ㄤ嬌鐢ㄩ緙栬瘧璇彞,浣犲氨鐢ㄤ笉鐫瀵逛紶鍏ョ殑鏁版嵁鍋氫換浣曡繃铏?鑰屽鏋滀嬌鐢ㄦ櫘閫氱殑statement, 鏈夊彲鑳借瀵筪rop,;絳夊仛璐瑰敖蹇冩満鐨勫垽鏂拰榪囪檻.
涓婇潰鐨勫嚑涓師鍥?榪樹笉瓚寵浣犲湪浠諱綍鏃跺欓兘浣跨敤PreparedStatement鍚?
鏈夌殑鏂頒漢鍙兘姝ゆ椂瀵逛簬鐢ㄦ硶榪樹笉澶悊瑙ｄ笅闈㈢粰涓皬渚嬪瓙
Code Fragment 1:
String updateString = "UPDATE COFFEES SET SALES = 75 " + "WHERE COF_NAME LIKE ′Colombian′";
stmt.executeUpdate(updateString);
Code Fragment 2:
PreparedStatement updateSales = con.prepareStatement("UPDATE COFFEES SET SALES = ? WHERE COF_NAME LIKE ? ");
updateSales.setInt(1, 75);
updateSales.setString(2, "Colombian");
updateSales.executeUpdate();
set涓殑1瀵瑰簲絎竴涓紵 2瀵瑰簲絎簩涓紵 鍚屾椂娉ㄦ剰浣爏et 鐨勭被鍨?鏄痠nt榪樻槸string 鍝堝搱寰堢畝鍗曞惂
鍘熸枃鍑哄錛?span style="font-family: Simsun; line-height: normal; font-size: medium; ">http://blog.csdn.net/spcusa/archive/2009/05/09/4164076.aspx
]]>