package cn.itheima.test;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

import org.junit.Test;

/**
 * 測試sql注入問題
 * 
 * @author Never Say Never
 * @date 2016年7月28日
 * @version V1.0
 */
public class TestLogin {

	@Test
	public void testLogin() {
		try {
			login1("zs' or 'zs", "zs");
		} catch (Exception e) {
			e.printStackTrace();
		}
	}

	/**
	 * 使用者登入方法
	 * 
	 * @param username
	 * @param password
	 * @throws ClassNotFoundException
	 * @throws SQLException
	 */
	public void login(String username, String password) throws ClassNotFoundException, SQLException {
		// 1.註冊驅動
		Class.forName("com.mysql.jdbc.Driver");
		// 2.獲取連線
		Connection conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/web08", "root", "root");
		// 3.建立執行sql語句的物件
		Statement stmt = conn.createStatement();
		// 4.書寫一個sql語句
		String sql = "select * from tbl_user where " + "uname='" + username + "' and upassword='" + password + "'";
		// 5.執行sql語句
		ResultSet rs = stmt.executeQuery(sql);
		// 6.對結果集進行處理
		if (rs.next()) {
			System.out.println("恭喜您，" + username + ",登入成功!");
			System.out.println(sql);
		} else {
			System.out.println("賬號或密碼錯誤!");
		}
		if (rs != null)
			rs.close();
		if (stmt != null)
			stmt.close();
		if (conn != null)
			conn.close();
	}

	public void login1(String username, String password) throws ClassNotFoundException, SQLException {
		// 1.註冊驅動
		Class.forName("com.mysql.jdbc.Driver");
		// 2.獲取連線
		Connection conn = DriverManager.getConnection("jdbc:mysql://localhost:3306/web08", "root", "root");
		// 3.編寫sql語句
		String sql = "select * from tbl_user where uname=? and upassword=?";
		// 4.建立預處理物件
		PreparedStatement pstmt = conn.prepareStatement(sql);
		// 5.設定引數(給佔位符)
		pstmt.setString(1, username);
		pstmt.setString(2, password);
		// 6.執行查詢操作
		ResultSet rs = pstmt.executeQuery();
		// 7.對結果集進行處理
		if (rs.next()) {
			System.out.println("恭喜您，" + username + ",登入成功!");
			System.out.println(sql);
		} else {
			System.out.println("賬號或密碼錯誤!");
		}
		if (rs != null)
			rs.close();
		if (pstmt != null)
			pstmt.close();
		if (conn != null)
			conn.close();
	}
}

 

package cn.itheima.test;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

import org.junit.Test;

/**
 * 測試查詢所有使用者的類
 * @author Administrator
 *
 */
public class QueryAll {
	
	@Test
	public void testQueryAll(){
		Connection conn= null;
		Statement stmt = null;
		ResultSet rs = null;
		try {
			//1.註冊驅動
			Class.forName("com.mysql.jdbc.Driver");
			//2.獲取連線
			String url ="jdbc:mysql://127.0.0.1:3306/web08?useUnicode=true&characterEncoding=utf8";
			String username="root";
			String password="root";
			conn = DriverManager.getConnection(url,username,password);
			//3.獲取執行sql語句物件
			stmt = conn.createStatement();
			//4.編寫sql語句
			String sql = "select * from tbl_user";
			//5.執行sql語句
			rs = stmt.executeQuery(sql);
			//6.處理結果集
			while(rs.next()){
				System.out.println("使用者名稱："+rs.getString(2)+" 密碼："+rs.getString("upassword"));
			}
		} catch (Exception e) {
			e.printStackTrace();
		}finally{
			if(rs!=null)
				try {
					rs.close();
				} catch (SQLException e) {
					e.printStackTrace();
				}
			if(stmt!=null)
				try {
					stmt.close();
				} catch (SQLException e) {
					e.printStackTrace();
				}
			if(conn!=null)
				try {
					conn.close();
				} catch (SQLException e) {
					e.printStackTrace();
				}
		}
	}
}