JAVA的经典安全问题SQL注入在JDBC中的引入-----JDBC

落日映苍穹つ 2024-03-23 19:42 6阅读 0赞

> ###  ###
> 
>     package com.powernode.jdbc;
>     
>     import java.sql.*;
>     import java.util.*;
>     
>     //模拟用户登录功能的实现
>     public class JDBCTest
>     {
>         private static ResourceBundle resourceBundle = ResourceBundle.getBundle("JDBC");
>         private static String url = resourceBundle.getString("url");
>         private static String user = resourceBundle.getString("user");
>         private static String pssword = resourceBundle.getString("password");
>         //SQL注入
>         //输入用户名fdsa
>         //输入密码fdsa' or '1'='1
>         //导致SQL注入的原因是什么?用户输入的内容参与了SQL语句的编译
>         //以上正好完成了SQL语句的拼接,发送了SQL语句给DBMS去执行,将非法信息编译进去了,导致扭曲了SQL语句原意
>         //根本原因是用户输入的信息含有SQL语句的关键字,这些关键字参与了SQL语句的编译过程(不要让它参与编译),导致扭曲了SQL原意,达到了SQL注入
>         public static void main(String[] args)
>         {
>             try
>             {
>                 //初始化界面
>                 Map<String,String> userLoginInfo = initUI();
>                 //验证用户名和密码
>                 boolean flag = Login(userLoginInfo);
>                 //最后输出结果
>                 System.out.println(flag ? "登陆成功" : "登陆失败");
>             }
>             catch (Exception e)
>             {
>                 throw new RuntimeException(e);
>             }
>         }
>     
>         //这是用户登录信息,true是成功,false是失败
>         private static boolean Login(Map<String, String> userLoginInfo)
>         {
>             Connection connection = null;
>             Statement statement = null;
>             ResultSet resultSet = null;
>             String username = userLoginInfo.get("用户名");
>             String password = userLoginInfo.get("密码");
>             boolean flag = false;
>             try
>             {
>                 Class.forName(resourceBundle.getString("Driver"));
>                 connection = DriverManager.getConnection(url,user,pssword);
>                 statement = connection.createStatement();
>                 String sql = "select * from users where username = '" + username + "' and pssword = '" + password + "'";
>                 resultSet = statement.executeQuery(sql);
>                 flag = resultSet.next();
>             }
>             catch (Exception e)
>             {
>                 throw new RuntimeException(e);
>             }
>             finally
>             {
>                 if (resultSet != null)
>                 {
>                     try
>                     {
>                         resultSet.close();
>                     }
>                     catch (SQLException e)
>                     {
>                         throw new RuntimeException(e);
>                     }
>                 }
>                 if (connection != null)
>                 {
>                     try
>                     {
>                         connection.close();
>                     }
>                     catch (SQLException e)
>                     {
>                         throw new RuntimeException(e);
>                     }
>                 }
>                 if (statement != null)
>                 {
>                     try
>                     {
>                         statement.close();
>                     }
>                     catch (SQLException e)
>                     {
>                         throw new RuntimeException(e);
>                     }
>                 }
>             }
>             return flag;
>         }
>     
>         //初始化用户界面,用户在界面输入以后,我们需要一个返回值,确定是不是登录了
>         private static Map initUI()
>         {
>             Scanner in = new Scanner(System.in);
>             System.out.println("输入用户名");
>             String username = in.nextLine();
>             System.out.println("输入密码");
>             String password = in.nextLine();
>             Map<String,String> map = new HashMap<>();
>             map.put("用户名",username);
>             map.put("密码",password);
>             return map;
>         }
>     }
> 
> package com.powernode.jdbc;  
>   
> import java.sql.\*;  
> import java.util.\*;  
>   
> //模拟用户登录功能的实现  
> public class JDBCTest  
> \{  
> private static ResourceBundle resourceBundle = ResourceBundle.getBundle("JDBC");  
> private static String url = resourceBundle.getString("url");  
> private static String user = resourceBundle.getString("user");  
> private static String pssword = resourceBundle.getString("password");  
> //SQL注入  
> //输入用户名fdsa  
> //输入密码fdsa' or '1'='1  
> //导致SQL注入的原因是什么?用户输入的内容参与了SQL语句的编译  
> //以上正好完成了SQL语句的拼接,发送了SQL语句给DBMS去执行,将非法信息编译进去了,导致扭曲了SQL语句原意  
> //根本原因是用户输入的信息含有SQL语句的关键字,这些关键字参与了SQL语句的编译过程(不要让它参与编译),导致扭曲了SQL原意,达到了SQL注入  
> public static void main(String\[\] args)  
> \{  
> try  
> \{  
> //初始化界面  
> Map<String,String> userLoginInfo = initUI();  
> //验证用户名和密码  
> boolean flag = Login(userLoginInfo);  
> //最后输出结果  
> System.out.println(flag ? "登陆成功" : "登陆失败");  
> \}  
> catch (Exception e)  
> \{  
> throw new RuntimeException(e);  
> \}  
> \}  
>   
> //这是用户登录信息,true是成功,false是失败  
> private static boolean Login(Map<String, String> userLoginInfo)  
> \{  
> Connection connection = null;  
> Statement statement = null;  
> ResultSet resultSet = null;  
> String username = userLoginInfo.get("用户名");  
> String password = userLoginInfo.get("密码");  
> boolean flag = false;  
> try  
> \{  
> Class.forName(resourceBundle.getString("Driver"));  
> connection = DriverManager.getConnection(url,user,pssword);  
> statement = connection.createStatement();  
> String sql = "select \* from users where username = '" + username + "' and pssword = '" + password + "'";  
> resultSet = statement.executeQuery(sql);  
> flag = resultSet.next();  
> \}  
> catch (Exception e)  
> \{  
> throw new RuntimeException(e);  
> \}  
> finally  
> \{  
> if (resultSet != null)  
> \{  
> try  
> \{  
> resultSet.close();  
> \}  
> catch (SQLException e)  
> \{  
> throw new RuntimeException(e);  
> \}  
> \}  
> if (connection != null)  
> \{  
> try  
> \{  
> connection.close();  
> \}  
> catch (SQLException e)  
> \{  
> throw new RuntimeException(e);  
> \}  
> \}  
> if (statement != null)  
> \{  
> try  
> \{  
> statement.close();  
> \}  
> catch (SQLException e)  
> \{  
> throw new RuntimeException(e);  
> \}  
> \}  
> \}  
> return flag;  
> \}  
>   
> //初始化用户界面,用户在界面输入以后,我们需要一个返回值,确定是不是登录了  
> private static Map initUI()  
> \{  
> Scanner in = new Scanner(System.in);  
> System.out.println("输入用户名");  
> String username = in.nextLine();  
> System.out.println("输入密码");  
> String password = in.nextLine();  
> Map<String,String> map = new HashMap<>();  
> map.put("用户名",username);  
> map.put("密码",password);  
> return map;  
> \}  
> \}