mysql的安全漏洞的一種現象，就是利用轉義字元把 ' ' 化沒了，然後true 起作用啦

所以~ select * from stu where StuName = true~~~~~

程式碼舉例：

//登入系統
System.out.println("請輸入使用者名稱:");
Scanner scanner = new Scanner(System.in);
String name = scanner.nextLine();
System.out.println("請輸入密碼:");
String password = scanner.nextLine();
//拼接成sql語句
String sql = String.format("select * from stu where StuName='%s' and LoginPwd='%s'",name,password);
//連線伺服器驗證密碼是否正確
Connection connection = JDBCUtil.GetConnection(); //自定義的JDBCUtil類封裝了連線sql的驅動器，以及返回一個連線到自己的伺服器Connection活動物件
Statement statement = null;
statement = connection.createStatement();
//執行sql語句
ResultSet resultSet = statement.executeQuery(sql);
if(resultSet.next()){
    System.out.println("登入成功");
    System.out.println(sql);
}else{
    System.out.println("登入失敗！請重試");
}
 
  

解決：使用預編譯 PreparedStatement，建立引數化的sql語句

例如：String sql="select * from stu where StuName = ? and LoginPwd = ?"; //設定引數化sql語句，變數的值暫時用？代替

PreparedStatement preparement = connection.preparedStatement(sql);

preparement.setString(1, "易烊千璽");　　//設定引數

preparement.setString(2,"123445");

程式碼示例：

   //登入系統
        System.out.println("請輸入使用者名稱:");
        Scanner scanner = new Scanner(System.in);
        String name = scanner.nextLine();
        System.out.println("請輸入密碼:");
        String password = scanner.nextLine();
        //拼接成sql語句
//        String sql = String.format("select * from stu where StuName='%s' and LoginPwd='%s'",name,password);
        String sql = "select * from stu where StuName=? and LoginPwd=?;";
        //連線伺服器驗證密碼是否正確
        Connection connection = JDBCUtil.GetConnection(); //自定義的JDBCUtil類封裝了連線sql的驅動器，以及返回一個連線到自己的伺服器Connection活動物件
//        Statement statement = null;
//        statement = connection.createStatement();

        PreparedStatement preparedStatement = connection.prepareStatement(sql);
        //為每一個？賦值，下標從1開始
        preparedStatement.setString(1, name);
        preparedStatement.setString(2,password);
        //執行sql語句
//      ResultSet resultSet = statement.executeQuery(sql);

        ResultSet resultSet = preparedStatement.executeQuery();
        if(resultSet.next()){
            System.out.println("登入成功");
            System.out.println(sql);
        }else{
            System.out.println("登入失敗！請重試");
        }
    }