标签：exce efault man logo 记录 package finally source 也会
JDBC常用对象主要作用:
主要作用：
主要作用：
主要作用：
package com.kernel.test;
import org.junit.Test;
import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.Statement;
/**
* 演示JDBC注入漏洞
*/
public class JDBCDemo04 {
@Test
/**
* 测试SQL注入
*/
public void demo1() {
//boolean result = login("aaa", "11");
//boolean result = login("aaa‘ or ‘1=1", "5454545");
boolean result = login("aaa‘ -- ", "sjjkhnjkhnk");
System.out.println(result);
}
public boolean login(String username, String password) {
Connection connection = null;
Statement statement = null;
ResultSet resultSet = null;
try {
connection = DBUtil.getConnection();
statement = connection.createStatement();
String sql = "select * from user where username=‘" + username + "‘ and password=‘" + password + "‘";
resultSet = statement.executeQuery(sql);
if (resultSet.next()) {
return true;
} else {
return false;
}
} catch (Exception e) {
e.printStackTrace();
} finally {
DBUtil.release(resultSet, statement, connection);
}
return false;
}
}
我们来看下这是什么原因，有这样一行代码
boolean result = login("aaa‘ or ‘1=1", "5454545");
这时，sql就变成了这样
sql = "select * from user where username=‘aaa‘ or ‘1=1‘ and password=‘545445‘"；
SQL会首先判断and这个语句，and的结果为false，username=‘aaa‘，结果为true，true or false返回true
再来看第二条
sql "select * from user where username=‘aaa‘ -- and password=‘sjjkhnjkhnk‘
-- 是注释的意思，意思就是注释后面的password=xxx，肯定返回true如何解决呢
PrepareStatement是Statement的子接口，它的实例对象可以通过调用Connection.prepareStatement(sql)方法获得，相对于Statement对象而言：
package com.kernel.test;
import org.junit.Test;
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.Statement;
/**
* 演示JDBC注入漏洞
*/
public class JDBCDemo04 {
@Test
/**
* 测试SQL注入
*/
public void demo1() {
//boolean result = login("aaa", "11");
//boolean result = login("aaa‘ or ‘1=1", "5454545");
boolean result = logon("aaa‘ -- ", "sjjkhnjkhnk");
System.out.println(result);
}
/**
* 避免SQL注入漏洞
* @param username
* @param password
* @return
*/
public boolean logon(String username, String password) {
Connection connection = null;
PreparedStatement preparedStatement = null;
ResultSet resultSet = null;
try {
connection = DBUtil.getConnection();
String sql = "select * from user where username=? and password=?";
preparedStatement = connection.prepareStatement(sql);
preparedStatement.setString(1, username);
preparedStatement.setString(2, password);
resultSet = preparedStatement.executeQuery();
if (resultSet.next()) {
return true;
} else {
return false;
}
} catch (Exception e) {
e.printStackTrace();
} finally {
DBUtil.release(resultSet, (Statement) preparedStatement, connection);
}
return false;
}
/**
* 产生SQL注入漏洞
*
* @param username
* @param password
* @return
*/
public boolean login(String username, String password) {
Connection connection = null;
Statement statement = null;
ResultSet resultSet = null;
try {
connection = DBUtil.getConnection();
statement = connection.createStatement();
String sql = "select * from user where username=‘" + username + "‘ and password=‘" + password + "‘";
resultSet = statement.executeQuery(sql);
if (resultSet.next()) {
return true;
} else {
return false;
}
} catch (Exception e) {
e.printStackTrace();
} finally {
DBUtil.release(resultSet, statement, connection);
}
return false;
}
}
为什么使用它就可以避免SQL注入漏洞呢？那是因为创建对象的时候就将sql传递进去，并进行了预编译，即使后面通过变量传递了关键字进来，也会认为这是字符串连接池是创建和管理一个连接的缓冲池的技术，这些连接准备好被任何需要它们的线程使用
应用程序直接获得链接的缺点
用户每次请求都需要向数据库获得连接，而数据库创建连接通常需要消耗较大的资源，创建时消耗的事件也比较长，在高并发业务场景下，如果采用这种方式获得连接，极大浪费数据库的资源，并且容易造成数据库服务器内存溢出
那么连接池是怎么解决这个问题的呢
连接池中默认存放了若干个数据库连接对象，当用户请求与数据库进行连接时，直接从数据库中取出，当用户完成操作需要释放数据库连接资源时，销毁的连接回到连接池继续等待下一次用户的请求
C3P0的使用
package com.kernel.test;
import com.mchange.v2.c3p0.ComboPooledDataSource;
import org.junit.Test;
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
/**
* 演示连接池
*/
public class DataSourseDemo01 {
@Test
/**
* 手动设置连接池
*/
public void demo1() {
//获得连接
Connection connection = null;
PreparedStatement preparedStatement = null;
ResultSet resultSet = null;
try {
//创建连接池
ComboPooledDataSource dataSource = new ComboPooledDataSource();
//设置连接池参数
dataSource.setDriverClass("com.mysql.jdbc.Driver");
dataSource.setJdbcUrl("jdbc:mysql://127.0.0.1:3306/jdbctest");
dataSource.setUser("root");
dataSource.setPassword("123456");
dataSource.setMaxPoolSize(20);
connection = dataSource.getConnection();
String sql = "select * from user";
preparedStatement = connection.prepareStatement(sql);
resultSet = preparedStatement.executeQuery();
while (resultSet.next()) {
System.out.println(resultSet.getInt("uid") + "\t"
+ resultSet.getString("username") + "\t"
+ resultSet.getString("password") + "\t"
+ resultSet.getString("name"));
}
} catch (Exception e) {
e.printStackTrace();
} finally {
DBUtil.release(resultSet, preparedStatement, connection);
}
}
@Test
/**
* 读取配置文件设置连接池，默认读取src目录下的c3p0-config.xml文件
*/
public void demo2() {
//获得连接
Connection connection = null;
PreparedStatement preparedStatement = null;
ResultSet resultSet = null;
try {
//创建连接池
connection = DBUtil.getConnection();
String sql = "select * from user";
preparedStatement = connection.prepareStatement(sql);
resultSet = preparedStatement.executeQuery();
while (resultSet.next()) {
System.out.println(resultSet.getInt("uid") + "\t"
+ resultSet.getString("username") + "\t"
+ resultSet.getString("password") + "\t"
+ resultSet.getString("name"));
}
} catch (Exception e) {
e.printStackTrace();
} finally {
DButil2.release(resultSet, preparedStatement, connection);
}
}
}编写C3P0的配置文件
<?xml version="1.0" encoding="UTF-8"?>
<c3p0-config>
<default-config>
<property name="driverClass">com.mysql.jdbc.Driver</property>
<property name="jdbcUrl">jdbc:mysql:///jdbctest</property>
<property name="user">root</property>
<property name="password">123456</property>
<property name="initialPoolSize">5</property>
<property name="maxPoolSize">20</property>
</default-config>
</c3p0-config>标签：exce efault man logo 记录 package finally source 也会
原文地址：http://blog.51cto.com/13559120/2329053
