PreparedStatement

//SQL攻击：
//login()方法中有如下语句：
String sql = "SELECT * FROM user WHERE " +"username=‘" + username + "‘ and password=‘" + password + "‘";

//调用login方法
login("a‘ or ‘a‘=‘a", "a‘ or ‘a‘=‘a");

//组合起来的sql语句为：
SELECT * FROM tab_user WHERE username=‘a‘ or ‘a‘=‘a‘ and password=‘a‘ or ‘a‘=‘a‘         //总返回true

/*
         * 一、得到PreparedStatement
         * 1. 给出sql模板：所有的参数使用?来替代
         * 2. 调用Connection方法，得到PreparedStatement
         */
        String sql = "select * from t_user where username=? and password=?";
        PreparedStatement pstmt = con.prepareStatement(sql);
        
        /*
         * 二、为参数赋值
         */
        pstmt.setString(1, username);//给第1个问号赋值，值为username
        pstmt.setString(2, password);//给第2个问号赋值，值为password
        
        ResultSet rs = pstmt.executeQuery();//调用查询方法，向数据库发送查询语句
        
        pstmt.setString(1, "liSi");
        pstmt.setString(2, "123");
        
        pstmt.executeQuery();