private static boolean login(String name, String pw) {
Connection cn = null;
Statement st = null;
ResultSet rs = null;
try {
Class.forName("com.mysql.jdbc.Driver");
cn = DriverManager.getConnection("jdbc:mysql://localhost:3306/user","root","123");
st = cn.createStatement();
//存在sql注入隐患
rs = st.executeQuery("select count(1) from t_user where name='"+name+"' and pw='"+pw+"'");
while(rs.next()){
return rs.getInt(1)>0;
}
} catch (ClassNotFoundException e) {
// TODO Auto-generated catch block
e.printStackTrace();
} catch (SQLException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}finally {
CloseUtils.closeAll(rs,st,cn);
}
当输入 11111' or 1=1 # 时会直接登录成功，所以推荐使用PreparedStatement
好处： 1. 可解决sql注入问题 2: 已经预先编译，执行效率更高
