JDBC API详解3

//preparedStatement  预编译SQL语句并执行：防止SQL注入

//实现简单的用户登录
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.Statement;
import java.util.ArrayList;

public class UserLogin {
    public static void main(String[] args) throws Exception {
        //1.注册驱动
        Class.forName("com.mysql.cj.jdbc.Driver");

        //2.获取连接
        String url = "jdbc:mysql://127.0.0.1:3306/db1";
        String username = "root";
        String password = "1234";
        Connection conn = DriverManager.getConnection(url,username,password);
        
        //接受用户输入的账号和密码
        String name = "zhangsan";
        String pwd = "123";

        String sql = "select * from tb_user where username = '"+name+"' and password = '"+pwd+"'";

        //获取stmt对象
        Statement stmt = conn.createStatement();

        //执行sql语句
        ResultSet rs = stmt.executeQuery(sql);

        if(rs.next()){
            System.out.println("登陆成功~");
        }
        else{
            System.out.println("登陆失败~");
        }

        //释放资源
        rs.close();
        stmt.close();
        conn.close();
    }

}

/*preparedStatement 的使用

1.获取PreparedStatement对象，参数用 ？替代。
  String sql = "select * from tb_user where username = ? and password = ?"
  通过connection对象获取，并传入相应的sql语句
  PreparedStatement pstmt = conn.prepareStatement();
  
2.设置参数值
  PreparedStatement对象:setXxx(参数1，参数2);
  xxx:数据类型   参数1：?的位置编号，从1开始  参数2：？的值
  
3.执行SQL，不需要再传递值
  excuteUpdate();或
  excuteQuerry();
*/


import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;

public class PStatement {
    public static void main(String[] args) throws Exception {
        //1.注册驱动
        Class.forName("com.mysql.cj.jdbc.Driver");
        //2.获取连接
        String url = "jdbc:mysql://127.0.0.1:3306/db1";
        String username = "root";
        String password = "1234";
        Connection conn = DriverManager.getConnection(url,username,password);

        String name = "zhangsan";
        String pwd = "123";

        String sql = "select * from tb_user where username = ? and password = ?";

        PreparedStatement pstmt = conn.prepareStatement(sql);
        pstmt.setString(1,name);
        pstmt.setString(2,pwd);

        ResultSet rs = pstmt.executeQuery();

        if(rs.next()){
            System.out.println("登陆成功~");
        }
        else{
            System.out.println("登陆失败~");
        }

        //释放资源
        rs.close();
        pstmt.close();
        conn.close();
    }

}