00310_防止SQL注入

String sql = "insert into sort(sid,sname) values(?,?)";;
PreparedStatement预处理对象代码：
PreparedStatement psmt = conn.prepareStatement(sql)

int executeUpdate(); --执行insert update delete语句.
ResultSet executeQuery(); --执行select语句.
boolean execute(); --执行select返回true 执行其他的语句返回false

setString(2, "家用电器") 把SQL语句中第2个位置的占位符？ 替换成实际参数 "家用电器"

 1 import java.sql.Connection;
 2 import java.sql.DriverManager;
 3 import java.sql.PreparedStatement;
 4 import java.sql.ResultSet;
 5 import java.util.Scanner;
 6 
 7 public class JDBCDemo3 {
 8     public static void main(String[] args) throws Exception {
 9         Class.forName("com.mysql.jdbc.Driver");
10         String url = "jdbc:mysql://localhost:3306/mybase";
11         String username = "root";
12         String password = "root";
13         Connection con = DriverManager.getConnection(url, username, password);
14         Scanner sc = new Scanner(System.in);
15         String user = sc.nextLine();
16         String pass = sc.nextLine();
17 
18         // 执行SQL语句,数据表,查询用户名和密码,如果存在,登录成功,不存在登录失败
19         String sql = "SELECT * FROM users WHERE username=? AND PASSWORD=?";
20         // 调用Connection接口的方法prepareStatement,获取PrepareStatement接口的实现类
21         // 方法中参数,SQL语句中的参数全部采用问号占位符
22         PreparedStatement pst = con.prepareStatement(sql);
23         System.out.println(pst);
24         // 调用pst对象set方法,设置问号占位符上的参数
25         pst.setObject(1, user);
26         pst.setObject(2, pass);
27 
28         // 调用方法,执行SQL,获取结果集
29         ResultSet rs = pst.executeQuery();
30         while (rs.next()) {
31             System.out.println(rs.getString("username") + "   "
32                     + rs.getString("password"));
33         }
34 
35         rs.close();
36         pst.close();
37         con.close();
38     }
39 }