【Java编程】JDBC注入攻击-Statement 与 PreparedStatement

在上一篇我们介绍了如何使用JDBC驱动建立一个简单的连接，并实现使用Statement和PreparedStatement进行数据库查询，本篇blog将接着上篇blog通过SQL注入攻击比较Statement和PreparedStatement。当然这两者还有很多其他方面的不同，在之后的blog中会继续更新。

【Statement查询】

1、在DBHelper.java中新增一个通过username和password查询user的方法。

	public static void queryByUser(String username,String password) {
		Connection conn = DBConnection.getConnection();
		Statement stmt = null;
		ResultSet rs = null;
		try {
			stmt = conn.createStatement();
			rs = stmt.executeQuery("select * from user where username = ‘" + username+"‘ and password=‘"+password+"‘");
			while (rs.next()) {
				User user = new User();
				user.setId(rs.getInt("id"));
				user.setUsername(rs.getString("username"));
				user.setPassword(rs.getString("password"));
				user.setGender(rs.getBoolean("gender"));
				user.setRegtime(rs.getDate("regtime"));
				System.out.println(user.toString());
			}
		} catch (SQLException e) {
			e.printStackTrace();
		}finally {
			DBConnection.closeResultSet(rs);
			DBConnection.closeStatement(stmt);
			DBConnection.closeConnection(conn);
		}
	}

	public void queryByUserTest(){
		DBHelper.queryByUser("jack", "jack");
	}

Java端测试结果：

	public void queryByUserInjectTest(){
		DBHelper.queryByUser("hack", "‘ or ‘1‘=‘1");
	}

public static void queryPrepareByUser(String username,String password) {
		Connection conn = DBConnection.getConnection();
		PreparedStatement ps = null;
		ResultSet rs = null;
		try {
			ps = conn.prepareStatement("select * from user where username = ? and password = ?");
			ps.setString(1,username);// 设置占位符参数
			ps.setString(2, password);
			rs = ps.executeQuery();
			while (rs.next()) {
				User user = new User();
				user.setId(rs.getInt("id"));
				user.setUsername(rs.getString("username"));
				user.setPassword(rs.getString("password"));
				user.setGender(rs.getBoolean("gender"));
				user.setRegtime(rs.getDate("regtime"));
				System.out.println(user.toString());
			}
		} catch (SQLException e) {
			e.printStackTrace();
		} finally {
			DBConnection.closeResultSet(rs);
			DBConnection.closeStatement(ps);
			DBConnection.closeConnection(conn);
		}
	}

public void queryByPreparedUserTest(){
		DBHelper.queryPrepareByUser("jack", "jack");
	}

	public void queryByPreparedUserInjectTest(){
		DBHelper.queryPrepareByUser("hack", "‘ or ‘1‘=‘1");
	}

140514 10:42:42	   19 Query	SET character_set_results = NULL
		   19 Query	SHOW VARIABLES
		   19 Query	SHOW WARNINGS
		   19 Query	SHOW COLLATION
		   19 Query	SET autocommit=1
		   19 Prepare	select * from user where username = ? and password = ?
		   19 Execute	select * from user where username = ‘hack‘ and password = ‘\‘ or \‘1\‘=\‘1‘
		   19 Close stmt	
		   19 Quit