jdbc中sql注入

​

什么是sql注入呢

​百度百科​：SQL注入即是指web应用程序对用户输入数据的合法性没有判断或过滤不严，攻击者可以在web应用程序中事先定义好的查询语句的结尾上添加额外的SQL语句，在管理员不知情的情况下实现非法操作，以此来实现欺骗数据库服务器执行非授权的任意查询，从而进一步得到相应的数据信息

下面我们就通过一个例子来演示一下，例子是通过jdbc连接查account表中的数据，然后用实体类Account封装起来，返回这个类的集合

jdbc工具类代码

package com.lingaolu.Utils;

import java.io.FileReader;
import java.io.IOException;
import java.net.URL;
import java.sql.*;
import java.util.Properties;

/**
 * @author 林高禄
 * @create 2020-06-23-11:12
 */
public class JdbcUtils {
    private static String driver;
    private static String url;
    private static String userName;
    private static String pw;

    static{
        try {
            Properties p = new Properties();
            ClassLoader classLoader = JdbcUtils.class.getClassLoader();
            // 这个路径相对于src的路径来说
            URL resource = classLoader.getResource("com/lingaolu/file/jdbc.properties");
            String path = resource.getPath();
            p.load(new FileReader(path));
            driver = p.getProperty("driver");
            url = p.getProperty("url");
            userName = p.getProperty("user");
            pw = p.getProperty("password");
            Class.forName(driver);
        } catch (IOException e) {
            e.printStackTrace();
        } catch (ClassNotFoundException e) {
            e.printStackTrace();
        }
    }

    public static Connection createConnection() throws SQLException {
        return DriverManager.getConnection(url, userName, pw);
    }

    public static void close(Statement stmt,Connection con){
        if(null != stmt){
            try {
                stmt.close();
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }
        if(null != con){
            try {
                con.close();
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }
    }

    public static void close(ResultSet set,Statement s,Connection con){
        if(null != set){
            try {
                set.close();
            } catch (SQLException e) {
                e.printStackTrace();
            }
        }
        close(s,con);
    }
}

Account实体类代码

package com.lingaolu.jdbcConnector;

/**
 * @author 林高禄
 * @create 2020-06-24-8:28
 */
public class Account {
    private int id;
    private String name;
    private double balance;
    private int myAge;

    public int getId() {
        return id;
    }

    public void setId(int id) {
        this.id = id;
    }

    public String getName() {
        return name;
    }

    public void setName(String name) {
        this.name = name;
    }

    public double getBalance() {
        return balance;
    }

    public void setBalance(double balance) {
        this.balance = balance;
    }

    public int getMyAge() {
        return myAge;
    }

    public void setMyAge(int myAge) {
        this.myAge = myAge;
    }

    @Override
    public String toString() {
        return "Account{" +
                "id=" + id +
                ", name='" + name + '\'' +
                ", balance=" + balance +
                ", myAge=" + myAge +
                '}';
    }
}

测试Demo4的代码

package com.lingaolu.jdbcConnector;

import com.lingaolu.Utils.JdbcUtils;

import java.sql.*;
import java.util.ArrayList;
import java.util.List;

/**
 * @author 林高禄
 * @create 2020-06-24-09:04
 */
public class Demo4 {
    public static void main(String[] args) {
        List<Account> accounts = fineAccount("李四");
        accounts.forEach(System.out::println);
        System.out.println("----------------------------------");
        accounts = fineAccount("王五");
        accounts.forEach(System.out::println);
        System.out.println("----------------------------------");
        accounts = fineAccount("王五' or '1'='1");
        accounts.forEach(System.out::println);
    }

    public static List<Account> fineAccount(String accoutName){
        Connection con = null;
        Statement stmt = null;
        ResultSet resultSet = null;
        List<Account> rerurnList = new ArrayList<>();
        try {
            con = JdbcUtils.createConnection();
            stmt = con.createStatement();
            String sql = "select * from account where name='"+accoutName+"'";
            System.out.println(sql);
            resultSet = stmt.executeQuery(sql);
            Account acc = null;
            while(resultSet.next()){
                // 引号里的字段要与表里的一样
                int id = resultSet.getInt("id");
                String name = resultSet.getString("name");
                double balance = resultSet.getDouble("balance");
                int age = resultSet.getInt("age");

                acc = new Account();
                acc.setId(id);
                acc.setName(name);
                acc.setBalance(balance);
                acc.setMyAge(age);

                rerurnList.add(acc);
            }
        } catch (SQLException e) {
            e.printStackTrace();
        }finally {
            JdbcUtils.close(resultSet,stmt,con);
        }
        return rerurnList;
    }
}

表中的数据

运行输出：

select * from account where name='李四'
Account{id=2, name='李四', balance=1000.0, myAge=16}
----------------------------------
select * from account where name='王五'
----------------------------------
select * from account where name='王五' or '1'='1'
Account{id=1, name='张三', balance=500.0, myAge=17}
Account{id=2, name='李四', balance=1000.0, myAge=16}
Account{id=7, name='张三', balance=600.0, myAge=19}
Account{id=11, name='林帅', balance=20000.0, myAge=18}

从当前数据库数据和输出结果来看

• • 
    
• 查询“李四”的数据是正确的，只有1条
• 查询“王五”的数据是正确的，一条都没有
• 查询“王五' or '1'='1”的数据时，使用了sql注入，是的最后的查询sql为select * from account where name='王五' or '1'='1'，由于sql查询or的机制，所以会查出所有的数据
  • 
    

sql注入解决方案：PreparedStatement的介绍与解决sql注入