修改代码以防止SQL注入

Question

SQL注入的示例

以下用于执行登录功能的Java servlet代码通过接受用户输入来说明漏洞,而无需执行足够的输入验证或转义元字符:

String sql = "select * from user where username='" + username +"' and password='" + password + "'";
stmt = conn.createStatement();
rs = stmt.executeQuery(sql);
if (rs.next()) {
loggedIn = true;
    out.println("Successfully logged in");
} else {
    out.println("Username and/or password not recognized");
}

================

现在请告诉我如何修改此代码,以便它不受SQL注入

Answer 1

您需要使用PreparedStatement该类并添加参数.

请参阅文档.