实例介绍SQL注入以及如何解决
<h3>前言</h3>
<p>
sql注入即是指web应用程序对用户输入数据的合法性没有判断或过滤不严，攻击者可以在web应用程序中事先定义好的查询语句的结尾上添加额外的sql语句，在管理员不知情的情况下实现非法操作，以此来实现欺骗数据库服务器执行非授权的任意查询，从而进一步得到相应的数据信息。</p>
<h3>
1、sql注入案例</h3>
<p>
模拟一个用户登录的sql注入案例，用户在控制台上输入用户名和密码, 然后使用 statement 字符串拼接的方式实现用户的登录。</p>
<p>
<strong>1.1 数据库中先创建用户表及数据</strong></p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_551558">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
<div class="line number7 index6 alt2">
7</div>
<div class="line number8 index7 alt1">
8</div>
<div class="line number9 index8 alt2">
9</div>
<div class="line number10 index9 alt1">
10</div>
<div class="line number11 index10 alt2">
11</div>
<div class="line number12 index11 alt1">
12</div>
<div class="line number13 index12 alt2">
13</div>
<div class="line number14 index13 alt1">
14</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql comments">-- 创建一张用户表</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql keyword">create</code> <code class="sql keyword">table</code> <code class="sql plain">`users` (</code>
</div>
<div class="line number3 index2 alt2">
<code class="sql spaces"> </code><code class="sql plain">`id` </code><code class="sql keyword">int</code><code class="sql plain">(11) </code><code class="sql color1">not</code> <code class="sql color1">null</code> <code class="sql plain">auto_increment,</code>
</div>
<div class="line number4 index3 alt1">
<code class="sql spaces"> </code><code class="sql plain">`username` </code><code class="sql keyword">varchar</code><code class="sql plain">(20),</code>
</div>
<div class="line number5 index4 alt2">
<code class="sql spaces"> </code><code class="sql plain">`</code><code class="sql keyword">password</code><code class="sql plain">` </code><code class="sql keyword">varchar</code><code class="sql plain">(50),</code>
</div>
<div class="line number6 index5 alt1">
<code class="sql spaces"> </code><code class="sql keyword">primary</code> <code class="sql keyword">key</code> <code class="sql plain">(`id`)</code>
</div>
<div class="line number7 index6 alt2">
<code class="sql plain">) engine=innodb </code><code class="sql keyword">default</code> <code class="sql plain">charset=utf8;</code>
</div>
<div class="line number8 index7 alt1">
</div>
<div class="line number9 index8 alt2">
<code class="sql comments">-- 插入数据</code>
</div>
<div class="line number10 index9 alt1">
<code class="sql keyword">insert</code> <code class="sql keyword">into</code> <code class="sql plain">users(username,`</code><code class="sql keyword">password</code><code class="sql plain">`) </code><code class="sql keyword">values</code><code class="sql plain">(</code><code class="sql string">'张飞'</code><code class="sql plain">,</code><code class="sql string">'123321'</code><code class="sql plain">),(</code><code class="sql string">'赵云'</code><code class="sql plain">,</code><code class="sql string">'qazxsw'</code><code class="sql plain">),(</code><code class="sql string">'诸葛亮'</code><code class="sql plain">,</code><code class="sql string">'123qwe'</code><code class="sql plain">);</code>
</div>
<div class="line number11 index10 alt2">
<code class="sql keyword">insert</code> <code class="sql keyword">into</code> <code class="sql plain">users(username,`</code><code class="sql keyword">password</code><code class="sql plain">`) </code><code class="sql keyword">values</code><code class="sql plain">(</code><code class="sql string">'曹操'</code><code class="sql plain">,</code><code class="sql string">'741258'</code><code class="sql plain">),(</code><code class="sql string">'刘备'</code><code class="sql plain">,</code><code class="sql string">'plmokn'</code><code class="sql plain">),(</code><code class="sql string">'孙权'</code><code class="sql plain">,</code><code class="sql string">'!@#$%^'</code><code class="sql plain">);</code>
</div>
<div class="line number12 index11 alt1">
</div>
<div class="line number13 index12 alt2">
<code class="sql comments">-- 查看数据</code>
</div>
<div class="line number14 index13 alt1">
<code class="sql keyword">select</code> <code class="sql plain">* </code><code class="sql keyword">from</code> <code class="sql plain">users;</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
</div>
<p>
<img title="实例介绍SQL注入以及如何解决" alt="实例介绍SQL注入以及如何解决" loading="lazy" src="https://zhuji.jb51.net/uploads/img/202305/fd17d71931fd42c5f9a50f54f4b8dde4.jpg"></p>
<p>
<strong>1.2 编写一个登录程序</strong></p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_510364">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
<div class="line number7 index6 alt2">
7</div>
<div class="line number8 index7 alt1">
8</div>
<div class="line number9 index8 alt2">
9</div>
<div class="line number10 index9 alt1">
10</div>
<div class="line number11 index10 alt2">
11</div>
<div class="line number12 index11 alt1">
12</div>
<div class="line number13 index12 alt2">
13</div>
<div class="line number14 index13 alt1">
14</div>
<div class="line number15 index14 alt2">
15</div>
<div class="line number16 index15 alt1">
16</div>
<div class="line number17 index16 alt2">
17</div>
<div class="line number18 index17 alt1">
18</div>
<div class="line number19 index18 alt2">
19</div>
<div class="line number20 index19 alt1">
20</div>
<div class="line number21 index20 alt2">
21</div>
<div class="line number22 index21 alt1">
22</div>
<div class="line number23 index22 alt2">
23</div>
<div class="line number24 index23 alt1">
24</div>
<div class="line number25 index24 alt2">
25</div>
<div class="line number26 index25 alt1">
26</div>
<div class="line number27 index26 alt2">
27</div>
<div class="line number28 index27 alt1">
28</div>
<div class="line number29 index28 alt2">
29</div>
<div class="line number30 index29 alt1">
30</div>
<div class="line number31 index30 alt2">
31</div>
<div class="line number32 index31 alt1">
32</div>
<div class="line number33 index32 alt2">
33</div>
<div class="line number34 index33 alt1">
34</div>
<div class="line number35 index34 alt2">
35</div>
<div class="line number36 index35 alt1">
36</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql plain">package com.study.task0201;</code>
</div>
<div class="line number2 index1 alt1">
</div>
<div class="line number3 index2 alt2">
<code class="sql plain">import java.sql.*;</code>
</div>
<div class="line number4 index3 alt1">
<code class="sql plain">import java.util.scanner;</code>
</div>
<div class="line number5 index4 alt2">
</div>
<div class="line number6 index5 alt1">
<code class="sql keyword">public</code> <code class="sql plain">class testsqlin {</code>
</div>
<div class="line number7 index6 alt2">
<code class="sql spaces"> </code><code class="sql keyword">public</code> <code class="sql keyword">static</code> <code class="sql plain">void main(string[] args) throws classnotfoundexception, sqlexception {</code>
</div>
<div class="line number8 index7 alt1">
<code class="sql spaces"> </code><code class="sql plain">class.forname(</code><code class="sql string">"com.mysql.jdbc.driver"</code><code class="sql plain">);</code>
</div>
<div class="line number9 index8 alt2">
<code class="sql spaces"> </code><code class="sql plain">string url = </code><code class="sql string">"jdbc:mysql://127.0.0.1:3306/testdb?characterencoding=utf-8"</code><code class="sql plain">;</code>
</div>
<div class="line number10 index9 alt1">
<code class="sql spaces"> </code><code class="sql keyword">connection</code> <code class="sql plain">conn = drivermanager.getconnection(url,</code><code class="sql string">"root"</code><code class="sql plain">,</code><code class="sql string">"123456"</code><code class="sql plain">);</code>
</div>
<div class="line number11 index10 alt2">
<code class="sql spaces"> </code><code class="sql plain">//system.</code><code class="sql keyword">out</code><code class="sql plain">.println(conn);</code>
</div>
<div class="line number12 index11 alt1">
<code class="sql spaces"> </code><code class="sql plain">// 获取语句执行平台对象 statement</code>
</div>
<div class="line number13 index12 alt2">
<code class="sql spaces"> </code><code class="sql plain">statement smt = conn.createstatement();</code>
</div>
<div class="line number14 index13 alt1">
</div>
<div class="line number15 index14 alt2">
<code class="sql spaces"> </code><code class="sql plain">scanner sc = new scanner(system.</code><code class="sql color1">in</code><code class="sql plain">);</code>
</div>
<div class="line number16 index15 alt1">
<code class="sql spaces"> </code><code class="sql plain">system.</code><code class="sql keyword">out</code><code class="sql plain">.println(</code><code class="sql string">"请输入用户名："</code><code class="sql plain">);</code>
</div>
<div class="line number17 index16 alt2">
<code class="sql spaces"> </code><code class="sql plain">string username = sc.nextline();</code>
</div>
<div class="line number18 index17 alt1">
<code class="sql spaces"> </code><code class="sql plain">system.</code><code class="sql keyword">out</code><code class="sql plain">.println(</code><code class="sql string">"请输入密码："</code><code class="sql plain">);</code>
</div>
<div class="line number19 index18 alt2">
<code class="sql spaces"> </code><code class="sql plain">string </code><code class="sql keyword">password</code> <code class="sql plain">= sc.nextline();</code>
</div>
<div class="line number20 index19 alt1">
</div>
<div class="line number21 index20 alt2">
<code class="sql spaces"> </code><code class="sql plain">string sql = </code><code class="sql string">"select * from users where username = '"</code> <code class="sql plain">+ username + </code><code class="sql string">"' and password = '"</code> <code class="sql plain">+ </code><code class="sql keyword">password</code> <code class="sql plain">+</code><code class="sql string">"'"</code><code class="sql plain">; //打印出sql</code>
</div>
<div class="line number22 index21 alt1">
<code class="sql spaces"> </code><code class="sql plain">system.</code><code class="sql keyword">out</code><code class="sql plain">.println(sql);</code>
</div>
<div class="line number23 index22 alt2">
<code class="sql spaces"> </code><code class="sql plain">resultset resultset = smt.executequery(sql);</code>
</div>
<div class="line number24 index23 alt1">
<code class="sql spaces"> </code><code class="sql plain">if(resultset.</code><code class="sql keyword">next</code><code class="sql plain">()){</code>
</div>
<div class="line number25 index24 alt2">
<code class="sql spaces"> </code><code class="sql plain">system.</code><code class="sql keyword">out</code><code class="sql plain">.println(</code><code class="sql string">"登录成功！！！"</code><code class="sql plain">);</code>
</div>
<div class="line number26 index25 alt1">
<code class="sql spaces"> </code><code class="sql plain">}</code><code class="sql keyword">else</code><code class="sql plain">{</code>
</div>
<div class="line number27 index26 alt2">
<code class="sql spaces"> </code><code class="sql plain">system.</code><code class="sql keyword">out</code><code class="sql plain">.println(</code><code class="sql string">"用户名或密码错误，请重新输入！！！"</code><code class="sql plain">);</code>
</div>
<div class="line number28 index27 alt1">
<code class="sql spaces"> </code><code class="sql plain">}</code>
</div>
<div class="line number29 index28 alt2">
</div>
<div class="line number30 index29 alt1">
<code class="sql spaces"> </code><code class="sql plain">resultset.</code><code class="sql keyword">close</code><code class="sql plain">();</code>
</div>
<div class="line number31 index30 alt2">
<code class="sql spaces"> </code><code class="sql plain">smt.</code><code class="sql keyword">close</code><code class="sql plain">();</code>
</div>
<div class="line number32 index31 alt1">
<code class="sql spaces"> </code><code class="sql plain">conn.</code><code class="sql keyword">close</code><code class="sql plain">();</code>
</div>
<div class="line number33 index32 alt2">
</div>
<div class="line number34 index33 alt1">
<code class="sql spaces"> </code><code class="sql plain">}</code>
</div>
<div class="line number35 index34 alt2">
</div>
<div class="line number36 index35 alt1">
<code class="sql plain">}</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
</div>
<p>
<strong>1.3 正常登录</strong></p>
<p>
输入正确的用户名及密码后提示"登录成功"</p>
<p>
<img title="实例介绍SQL注入以及如何解决" alt="实例介绍SQL注入以及如何解决" loading="lazy" src="https://zhuji.jb51.net/uploads/img/202305/17ecd6521c4faba2657f184d86e2259e.jpg"></p>
<p>
<strong>1.4 登录失败</strong></p>
<p>
输入用户名或密码错误时，提示“用户名或密码错误，请重新输入”</p>
<p>
<img title="实例介绍SQL注入以及如何解决" alt="实例介绍SQL注入以及如何解决" loading="lazy" src="https://zhuji.jb51.net/uploads/img/202305/36ff1fa5b278359f2eb70d7803a431f3.jpg"></p>
<p>
<strong>1.5 模拟sql注入</strong></p>
<p>
拼接的字符串中有or '1'='1' 为恒成立条件，因此 及时前面的用户及密码不存在也会取出所有记录，因此提示"登录成功"</p>
<p>
<img title="实例介绍SQL注入以及如何解决" alt="实例介绍SQL注入以及如何解决" loading="lazy" src="https://zhuji.jb51.net/uploads/img/202305/ec914676b151011ff6a4261d5414beae.jpg"></p>
<p>
<strong>1.6 sql语法报错</strong></p>
<p>
使用拼接的方式，还会出现sql语法错误等报错，例如</p>
<p>
<img title="实例介绍SQL注入以及如何解决" alt="实例介绍SQL注入以及如何解决" loading="lazy" src="https://zhuji.jb51.net/uploads/img/202305/557fb4d6f7d2f6578291e4c3e6bb52bf.jpg"></p>
<h3>
2. 解决方案</h3>
<p>
使用statement方式，用户可以通过字符串拼接，改变原本sql真正的含义，导致存在sql注入的风险。解决sql注入，可以通过预处理对象preparedstatement来代替statement进行处理。</p>
<p>
<strong>2.1 程序</strong></p>
<div class="jb51code">
<div>
<div class="syntaxhighlightersql" id="highlighter_156441">
<div class="toolbar">
<span>?</span>
</div>
<table border="0" cellpadding="0" cellspacing="0"><tbody><tr>
<td class="gutter">
<div class="line number1 index0 alt2">
1</div>
<div class="line number2 index1 alt1">
2</div>
<div class="line number3 index2 alt2">
3</div>
<div class="line number4 index3 alt1">
4</div>
<div class="line number5 index4 alt2">
5</div>
<div class="line number6 index5 alt1">
6</div>
<div class="line number7 index6 alt2">
7</div>
<div class="line number8 index7 alt1">
8</div>
<div class="line number9 index8 alt2">
9</div>
<div class="line number10 index9 alt1">
10</div>
<div class="line number11 index10 alt2">
11</div>
<div class="line number12 index11 alt1">
12</div>
<div class="line number13 index12 alt2">
13</div>
<div class="line number14 index13 alt1">
14</div>
<div class="line number15 index14 alt2">
15</div>
<div class="line number16 index15 alt1">
16</div>
<div class="line number17 index16 alt2">
17</div>
<div class="line number18 index17 alt1">
18</div>
<div class="line number19 index18 alt2">
19</div>
<div class="line number20 index19 alt1">
20</div>
<div class="line number21 index20 alt2">
21</div>
<div class="line number22 index21 alt1">
22</div>
<div class="line number23 index22 alt2">
23</div>
<div class="line number24 index23 alt1">
24</div>
<div class="line number25 index24 alt2">
25</div>
<div class="line number26 index25 alt1">
26</div>
<div class="line number27 index26 alt2">
27</div>
<div class="line number28 index27 alt1">
28</div>
<div class="line number29 index28 alt2">
29</div>
<div class="line number30 index29 alt1">
30</div>
<div class="line number31 index30 alt2">
31</div>
<div class="line number32 index31 alt1">
32</div>
<div class="line number33 index32 alt2">
33</div>
<div class="line number34 index33 alt1">
34</div>
<div class="line number35 index34 alt2">
35</div>
<div class="line number36 index35 alt1">
36</div>
<div class="line number37 index36 alt2">
37</div>
<div class="line number38 index37 alt1">
38</div>
<div class="line number39 index38 alt2">
39</div>
<div class="line number40 index39 alt1">
40</div>
<div class="line number41 index40 alt2">
41</div>
</td>
<td class="code">
<div class="container">
<div class="line number1 index0 alt2">
<code class="sql plain">import java.sql.*;</code>
</div>
<div class="line number2 index1 alt1">
<code class="sql plain">import java.util.scanner;</code>
</div>
<div class="line number3 index2 alt2">
</div>
<div class="line number4 index3 alt1">
<code class="sql keyword">public</code> <code class="sql plain">class testsqlin {</code>
</div>
<div class="line number5 index4 alt2">
<code class="sql spaces"> </code><code class="sql keyword">public</code> <code class="sql keyword">static</code> <code class="sql plain">void main(string[] args) throws classnotfoundexception, sqlexception {</code>
</div>
<div class="line number6 index5 alt1">
<code class="sql spaces"> </code><code class="sql plain">class.forname(</code><code class="sql string">"com.mysql.jdbc.driver"</code><code class="sql plain">);</code>
</div>
<div class="line number7 index6 alt2">
<code class="sql spaces"> </code><code class="sql plain">string url = </code><code class="sql string">"jdbc:mysql://127.0.0.1:3306/testdb?characterencoding=utf-8"</code><code class="sql plain">;</code>
</div>
<div class="line number8 index7 alt1">
<code class="sql spaces"> </code><code class="sql keyword">connection</code> <code class="sql plain">conn = drivermanager.getconnection(url,</code><code class="sql string">"root"</code><code class="sql plain">,</code><code class="sql string">"123456"</code><code class="sql plain">);</code>
</div>
<div class="line number9 index8 alt2">
<code class="sql spaces"> </code><code class="sql plain">//system.</code><code class="sql keyword">out</code><code class="sql plain">.println(conn);</code>
</div>
<div class="line number10 index9 alt1">
<code class="sql spaces"> </code><code class="sql plain">// 获取语句执行平台对象 statement</code>
</div>
<div class="line number11 index10 alt2">
<code class="sql spaces"> </code><code class="sql plain">// statement smt = conn.createstatement();</code>
</div>
<div class="line number12 index11 alt1">
</div>
<div class="line number13 index12 alt2">
<code class="sql spaces"> </code><code class="sql plain">scanner sc = new scanner(system.</code><code class="sql color1">in</code><code class="sql plain">);</code>
</div>
<div class="line number14 index13 alt1">
<code class="sql spaces"> </code><code class="sql plain">system.</code><code class="sql keyword">out</code><code class="sql plain">.println(</code><code class="sql string">"请输入用户名："</code><code class="sql plain">);</code>
</div>
<div class="line number15 index14 alt2">
<code class="sql spaces"> </code><code class="sql plain">string username = sc.nextline();</code>
</div>
<div class="line number16 index15 alt1">
<code class="sql spaces"> </code><code class="sql plain">system.</code><code class="sql keyword">out</code><code class="sql plain">.println(</code><code class="sql string">"请输入密码："</code><code class="sql plain">);</code>
</div>
<div class="line number17 index16 alt2">
<code class="sql spaces"> </code><code class="sql plain">string </code><code class="sql keyword">password</code> <code class="sql plain">= sc.nextline();</code>
</div>
<div class="line number18 index17 alt1">
</div>
<div class="line number19 index18 alt2">
<code class="sql spaces"> </code><code class="sql plain">string sql = </code><code class="sql string">"select * from users where username = ? and password = ? "</code><code class="sql plain">;</code>
</div>
<div class="line number20 index19 alt1">
<code class="sql spaces"> </code><code class="sql plain">// system.</code><code class="sql keyword">out</code><code class="sql plain">.println(sql);</code>
</div>
<div class="line number21 index20 alt2">
<code class="sql spaces"> </code><code class="sql plain">// resultset resultset = smt.executequery(sql);</code>
</div>
<div class="line number22 index21 alt1">
<code class="sql spaces"> </code><code class="sql plain">preparedstatement preparedstatement = conn.preparestatement(sql);</code>
</div>
<div class="line number23 index22 alt2">
<code class="sql spaces"> </code><code class="sql plain">preparedstatement.setstring(1,username);</code>
</div>
<div class="line number24 index23 alt1">
<code class="sql spaces"> </code><code class="sql plain">preparedstatement.setstring(2,</code><code class="sql keyword">password</code><code class="sql plain">);</code>
</div>
<div class="line number25 index24 alt2">
</div>
<div class="line number26 index25 alt1">
<code class="sql spaces"> </code><code class="sql plain">resultset resultset = preparedstatement.executequery();</code>
</div>
<div class="line number27 index26 alt2">
<code class="sql spaces"> </code><code class="sql plain">if(resultset.</code><code class="sql keyword">next</code><code class="sql plain">()){</code>
</div>
<div class="line number28 index27 alt1">
<code class="sql spaces"> </code><code class="sql plain">system.</code><code class="sql keyword">out</code><code class="sql plain">.println(</code><code class="sql string">"登录成功！！！"</code><code class="sql plain">);</code>
</div>
<div class="line number29 index28 alt2">
<code class="sql spaces"> </code><code class="sql plain">}</code><code class="sql keyword">else</code><code class="sql plain">{</code>
</div>
<div class="line number30 index29 alt1">
<code class="sql spaces"> </code><code class="sql plain">system.</code><code class="sql keyword">out</code><code class="sql plain">.println(</code><code class="sql string">"用户名或密码错误，请重新输入！！！"</code><code class="sql plain">);</code>
</div>
<div class="line number31 index30 alt2">
<code class="sql spaces"> </code><code class="sql plain">}</code>
</div>
<div class="line number32 index31 alt1">
</div>
<div class="line number33 index32 alt2">
</div>
<div class="line number34 index33 alt1">
<code class="sql spaces"> </code><code class="sql plain">preparedstatement.</code><code class="sql keyword">close</code><code class="sql plain">();</code>
</div>
<div class="line number35 index34 alt2">
<code class="sql spaces"> </code><code class="sql plain">resultset.</code><code class="sql keyword">close</code><code class="sql plain">();</code>
</div>
<div class="line number36 index35 alt1">
<code class="sql spaces"> </code><code class="sql plain">// smt.</code><code class="sql keyword">close</code><code class="sql plain">();</code>
</div>
<div class="line number37 index36 alt2">
<code class="sql spaces"> </code><code class="sql plain">conn.</code><code class="sql keyword">close</code><code class="sql plain">();</code>
</div>
<div class="line number38 index37 alt1">
</div>
<div class="line number39 index38 alt2">
<code class="sql spaces"> </code><code class="sql plain">}</code>
</div>
<div class="line number40 index39 alt1">
</div>
<div class="line number41 index40 alt2">
<code class="sql plain">}</code>
</div>
</div>
</td>
</tr></tbody></table>
</div>
</div>
</div>
<p>
<strong>2.2 正常登录</strong></p>
<p>
<img title="实例介绍SQL注入以及如何解决" alt="实例介绍SQL注入以及如何解决" loading="lazy" src="https://zhuji.jb51.net/uploads/img/202305/802ea5bb8e96ada45b81e3cefd46c9ec.jpg"></p>
<p>
<strong>2.3 用户名密码错误</strong></p>
<p>
当用户名或密码输入错误时，会提示“用户名或密码错误，请重新输入”</p>
<p>
<img title="实例介绍SQL注入以及如何解决" alt="实例介绍SQL注入以及如何解决" loading="lazy" src="https://zhuji.jb51.net/uploads/img/202305/ed8a2b7c2985c1661009c3acee777d16.jpg"></p>
<p>
<strong>2.4 模拟sql注入</strong></p>
<p>
按照之前的情况，进行sql注入的写法，测试后不再出现sql注入情况。</p>
<p>
<img title="实例介绍SQL注入以及如何解决" alt="实例介绍SQL注入以及如何解决" loading="lazy" src="https://zhuji.jb51.net/uploads/img/202305/04e9d6890df5deaa05c92a8e6b2d1fbb.jpg"></p>
<p>
<strong>2.5 模拟sql语法错误</strong></p>
<p>
使用预处理类后，输入带有单引号或双引号的内容也不会再出现sql语法错误的报错</p>
<p>
<img title="实例介绍SQL注入以及如何解决" alt="实例介绍SQL注入以及如何解决" loading="lazy" src="https://zhuji.jb51.net/uploads/img/202305/40b45d5d9d59f243b3b3ecf9e73a73d7.jpg"></p>
<h3>
3. 小结</h3>
<p>
statement 与 preparedstatement的主要区别如下：</p>
<ul>
<li>
statement用于执行静态sql语句，在执行时，必须指定一个事先准备好的sql语句</li>
<li>
preparestatement是预编译的sql语句对象，语句中可以包含动态参数“?”，在执行时可以为“?”动态设置参数值</li>
<li>
preparestatement可以减少编译次数提高数据库性能</li>
</ul>
<h3>
总结</h3>
<p>
到此这篇关于sql注入以及如何解决的文章就介绍到这了,更多相关sql注入及解决内容请搜索以前的文章或继续浏览下面的相关文章希望大家以后多多支持！</p>
<p>
原文链接：https://www.cnblogs.com/gjc592/p/14167666.html</p>
頁:
[1]