JDBC

Statement的不足

1.大量的拼接，可读性低

 2.sql注入

Connection conn = null;
        Statement stmt = null;
        ResultSet re = null;
        conn = GetConnection.test();
        stmt = conn.createStatement();
        Scanner sc = new Scanner(System.in);
        System.out.println("请输入用户名");
        String username = sc.next();
        System.out.println("请输入用户密码");
        String password = sc.next();
        String sql = "select username,password from user where username = '"
                + username + "' and password = " + password + "'";
        re = stmt.executeQuery(sql);
        if(re.next()){
            System.out.println("登录成功" + username);
        }else {
            System.out.println("error");
        }

sql注入

通过字符串拼接，可以的一个恒等的sql语句，可以跳过某些判断

select * from user where username = 'zxcvzxcvzxcv' and password = 'b' or '1' = '1'

PreparedStatement

1.通过conn获取的对象

2.是Statement接口的子接口

3.sql语句中可以传参，用？占位，通过setXXX方法给？赋值

4.提高性能

5.可以避免sql注入

        Connection conn = null;
        PreparedStatement pstmt = null;

        String sql = "update teacher set name = ? where id =?";
        //预编译
        conn = GetConnection.test();
        pstmt = conn.prepareStatement(sql);
        //给占位符赋值，根据位置
        pstmt.setString(1,"jj");
        pstmt.setInt(2,6);

        //执行sql
        int i = pstmt.executeUpdate();
        System.out.println(i);
        conn.close();
        pstmt.close();