Research on preventing SQL injection (Java code implementation)

 

There are two methods: one is to judge the variables obtained by login with special characters

One is to use preparedstatement for query during login, which can be effectively used for SQL injection.

 

Method 1

Sqlstring. Java

1. Package com. Test. util;
3. Public class sqlstring {
4. Public static Boolean SQL _inj (string Str ){
5. String inj_str = "': And: Exec: insert: select: delete: Update: Count: *: %: CHR: Mid: MASTER: truncate: Char: declare:;: or: -: + :,";
6. String inj_stra [] = inj_str.split (":");
7. For (INT I = 0; I <inj_stra.length; I ++ ){
8. If (Str. indexof (inj_stra [I])! =-1 ){
9. Return false;
10. }
11. }
12. Return true;
13. }
15. }

Use the following statement when calling:

Boolean F = sqlstring. SQL _inj (username );

 

PS: I have read the above Code on the Internet. They use the separator "|", but I found that string inj_stra [] = inj_str.split ("| "); all the characters are separated. instead of splitting strings, they are split into characters. I use jdk1.5. I don't know if it is a Java version, the example of the jdk1.5 API is separated by ":", so I can use this symbol to split each string.

 

The second method is to use preparedstatement during query.

1. SQL = "select * from Admin where username =? And Password =? ";
2. Preparedstatement psmt = con. preparestatement (SQL );
3. Psmt. setstring (1, username );
4. Psmt. setstring (2, password );
5. Resultset rs = psmt.exe cutequery ();
6. If (Rs. Next ){
7. Rs. Close ();
8. Con. Close ();
9. Return false;
10. }
11. Else {
12. Rs. Close ();
13. Con. Close ();
14. Return true;
15. }

In this way, you can