PreparedStatement使用

1. PreparedStatement插入数据SQL完成

@Test
public void testInsert() { User user = new User(10, "逗比匿名君", "123456"); Connection connection = null; PreparedStatement preparedStatement = null; try {// 获取数据库连接 connection = JdbcUtil.getConnection(); // 准备SQL语句 // ? 表示SQL语句参数占位符！！！ String sql = "insert into nzgp2001.user(id, userName, password) VALUE (?,?,?)";// 预处理SQL语句，获取PreparedStatement对象 preparedStatement = connection.prepareStatement(sql); // SQL语句赋值操作,SQL语句参数是从1开始 preparedStatement.setObject(1, user.getId()); preparedStatement.setObject(2, user.getUserName()); preparedStatement.setObject(3, user.getPassword()); // 使用PreparedStatement执行SQL语句 int affectedRows = preparedStatement.executeUpdate(); System.out.println("affectedRows:" + affectedRows); } catch (SQLException e) { e.printStackTrace(); } finally { JdbcUtil.close(connection, preparedStatement);}
}

2. PreparedStatment修改SQL完成

@Test
public void testUpdate() { User user = new User(10, "逗比匿名君", "航海中路彭 于晏"); Connection connection = null; PreparedStatement preparedStatement = null; try {connection = JdbcUtil.getConnection(); String sql = "update user set userName = ?, password = ? where id = ?"; preparedStatement = connection.prepareStatement(sql); // 赋值SQL语句参数 preparedStatement.setObject(1, user.getUserName()); preparedStatement.setObject(2, user.getPassword()); preparedStatement.setObject(3, user.getId()); int affectedRows = preparedStatement.executeUpdate(); System.out.println("affectedRows:" + affectedRows); } catch (SQLException e) { e.printStackTrace(); } finally { JdbcUtil.close(connection, preparedStatement);}
}

3. PreparedStatment删除SQL完成

@Test
public void testDelete() { int id = 7; Connection connection = null; PreparedStatement preparedStatement = null; try {connection = JdbcUtil.getConnection(); String sql = "delete from user where id = ?"; preparedStatement = connection.prepareStatement(sql); // 赋值参数 preparedStatement.setObject(1, id); int affectedRows = preparedStatement.executeUpdate(); System.out.println("affectedRows:" + affectedRows); } catch (SQLException e) { e.printStackTrace(); } finally { JdbcUtil.close(connection, preparedStatement); }
}

4. PreparedStatment查询SQL完成

@Test
public void testSelectOne() { int id = 10; User user = null; ResultSet resultSet = null; Connection connection = null; PreparedStatement preparedStatement = null; try {connection = JdbcUtil.getConnection(); String sql = "select * from user where id = ?"; preparedStatement = connection.prepareStatement(sql); // 赋值参数 preparedStatement.setObject(1, id); resultSet = preparedStatement.executeQuery(); if (resultSet.next()) { String userName = resultSet.getString("userName"); String password = resultSet.getString("password"); user = new User(id, userName, password);}if (user != null) { System.out.println(user); } } catch (SQLException e) {e.printStackTrace(); } finally { JdbcUtil.close(connection, preparedStatement, resultSet); }
}@Test
public void testSelectAll() { List<User> list = new ArrayList<>(); ResultSet resultSet = null; Connection connection = null; PreparedStatement preparedStatement = null; try {connection = JdbcUtil.getConnection(); String sql = "select * from user"; preparedStatement = connection.prepareStatement(sql); resultSet = preparedStatement.executeQuery(); while (resultSet.next()) { int id = resultSet.getInt("id"); String userName = resultSet.getString("userName"); String password = resultSet.getString("password"); list.add(new User(id, userName, password)); }for (User user : list) { System.out.println(user); } } catch (SQLException e) { e.printStackTrace(); } finally { JdbcUtil.close(connection, preparedStatement, resultSet); }
}

4. SQL注入问题

Statement是一个SQL语句搬运工对象，不存在SQL语句语预处理能力，Java代码SQL语句原封不动搬运到数据库！！！
PreparedStatement 存在SQL语句预处理过程，这个过程可以有效的防止一定条件的SQL注入
Statement存在SQL注入问题，而PreparedStatemen可以有效的避免SQL注入

墙裂推荐使用PreparedStatement

PreparedStatement操作性更强
PreparedStatement安全性更高

import util.JdbcUtil;
import java.sql.*;
/**
* 使用Statement和PreparedStatement完成Select操作
*/
public class Demo1 { private static String userName = "逗比匿名君"; private static String password = "fdafdsafdsa' or 1=1 -- "; public static void main(String[] args) { /*Statement是一个SQL语句搬运工对象，不存在SQL语句语预处理能力，Java代码SQL语句原封不动搬运到数据库！！！ PreparedStatement 存在SQL语句预处理过程，这个过 程可以有效的防止一定条件的SQL注入 */statementSelect(); preparedStatementSelect(); }public static void statementSelect() { ResultSet resultSet = null; Statement statement = null; Connection connection = null; try {connection = JdbcUtil.getConnection(); statement = connection.createStatement(); // SQL语句准备 String sql = "select * from user where userName = '" + userName + "' and password = '" + password + "'";/*select * from user where userName = '逗 比匿名君' and password = 'fdafdsafdsa' or 1=1 -- ' */resultSet = statement.executeQuery(sql); if (resultSet.next()) { System.out.println("Statement 登陆 成功"); } else { System.out.println("Statement 登陆 失败"); } } catch (SQLException e) { e.printStackTrace(); } finally {  JdbcUtil.close(connection, statement, resultSet); } }public static void preparedStatementSelect() { ResultSet resultSet = null; PreparedStatement preparedStatement = null; Connection connection = null; try {connection = JdbcUtil.getConnection(); String sql = "select * from user where userName = ? and password = ?";preparedStatement = connection.prepareStatement(sql); preparedStatement.setObject(1, userName); preparedStatement.setObject(2, password);resultSet = preparedStatement.executeQuery(); if (resultSet.next()) { System.out.println("PreparedStatement 登陆成功"); } else { System.out.println("PreparedStatement 登陆失败"); } } catch (SQLException e) { e.printStackTrace(); } finally { JdbcUtil.close(connection, preparedStatement, resultSet); } }
}

PreparedStatement使用相关推荐

resultset mysql_MySQL数据库学习笔记（九）----JDBC的ResultSet接口（查询操作）、PreparedStatement接口重构增删改查（含SQL注入的解释）...
[声明] 欢迎转载,但请保留文章原始出处→_→ [正文] 一.ResultSet接口的介绍: 对数据库的查询操作,一般需要返回查询结果,在程序中,JDBC为我们提供了ResultSet接口来专门处理查 ...
PreparedStatement
该 PreparedStatement接口继承Statement,并与之在两方面有所不同: PreparedStatement 实例包含已编译的 SQL 语句.这就是使语句"准备好" ...
关于JDBC中的 PreparedStatement 的使用讲解
**关于JDBC中的 PreparedStatement 的使用讲解@**TOC 文章转载于博客 https://www.cnblogs.com/ysw-go/p/5459330.html 如有侵权, ...
preparedStatement平台：
public class cs{ public static void main(String[] args){ try{ class.forName("com.mysql.jdbc.Dri ...
详解PreparedStatement
详解PreparedStatement /*** PrepareStatement 测试插入数据库*//*** 如果使用Statement,那么就必须在SQL语句中,实际地去嵌入值,比如之前的inse ...
JDBC--Statement,PreparedStatement,CallableStatement的区别
JDBC: Statement(接口) | PreparedStatement(接口) | CallableStatement(接口) 以上三者为继承关系. 1).概念: Stat ...
PreparedStatement和CallableStatement都可以调用存储过程
2019独角兽企业重金招聘Python工程师标准>>> 他们都可以调用存储过程,上午收了下主要区别.但是等于放屁,说了一大推也没说个所以然,就看见了这一句,说是CallableSta ...
【转】JDBC为什么要使用PreparedStatement而不是Statement
http://www.importnew.com/5006.html PreparedStatement是用来执行SQL查询语句的API之一,Java提供了 Statement.PreparedSta ...
java.lang.AbstractMethodError: com.mysql.jdbc.PreparedStatement.setCharacterStream(ILjava/io/Reader;
出现上述异常是在使用MySQL进行大文本数据的读写时,使用PreparedStatement中的 setCharacterStream(int parameterIndex,Reader reader ...
JDBC PreparedStatement 实现原理【推荐阅读】
???关注微信公众号:[芋艿的后端小屋]有福利: RocketMQ / MyCAT / Sharding-JDBC 所有源码分析文章列表 RocketMQ / MyCAT / Sharding-JDB ...

PreparedStatement使用

1. PreparedStatement插入数据SQL完成

2. PreparedStatment修改SQL完成

3. PreparedStatment删除SQL完成

4. PreparedStatment查询SQL完成

4. SQL注入问题

PreparedStatement使用相关推荐

最新文章

热门文章