SQL注入

import utils.JdbcUtils;

import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

public class SQL注入 {
public static void main(String[] args) {
login("root'or'1=1", "123456'or'1=1");//'or'1=1就是sql注入
}
public static void login(String userName, String password){
Connection connection = null;
Statement statement = null;
ResultSet resultSet = null;
try {

connection = JdbcUtils.getConnection();//获取数据库连接
statement = connection.createStatement();//获得SQL的执行对象
String sql = "select * from users where name='"+userName+"' and password='"+password+"'";

resultSet = statement.executeQuery(sql);//执行SQL语句
while (resultSet.next()){
System.out.println(resultSet.getString("name"));
System.out.println(resultSet.getString("password"));
System.out.println(resultSet.getString("email"));
System.out.println(resultSet.getString("birthday"));
System.out.println("------------------------------------");
}
} catch (SQLException e) {
e.printStackTrace();
}finally {
JdbcUtils.release(connection,statement,resultSet);
}

}
}