java的SQL注入-PreparedStatement

1.SQL注入

select count(1) from a where name = 'name输入值' and mobile = 'mobile输入值'

原本软件必须要两个输入项都匹配才能命中数据，返回。

这时恶意的人，只输入name输入值为 ‘or 1= 1 – 时

select count(1) from crm_admin where name = ''or 1= 1 -- ' and mobile = 'mobile输入值'

这时就会返回值

2.PreparedStatement(准备好的Statement)

select count(1) from a where name = 'name输入值' and mobile = 'mobile输入值'

语句会变为

select count(1) from a where name = ？ and mobile = ？

输入参数会做为一个字符串传进去，不再进行sql的解析与准备

select count(1) from crm_admin where name = '\'or 1= 1 --' and mobile = '1580000001'