Question

关于在java中使用sql代码

sql命令 select * from student limit(1,3)
在java中好像不能写成select * from student limit(?,?)
应该怎么写，要防止sql注入的

Answer 1

mport java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;

public class ConnDB
{
public static void main(String[] args)
{
try
{
//我这里用mysql数据库
Class.forName("com.mysql.jdbc.Driver");

String url = "jdbc:mysql://localhost:3306/mytest";

Connection conn = DriverManager.getConnection(url, "root", "123");

String sql = "select * from user limit ?,?";//这里没有括号

PreparedStatement ps = conn.prepareStatement(sql);

ps.setInt(1, 1);//为问号赋值
ps.setInt(2, 3);

ResultSet rs = ps.executeQuery();

while(rs.next())
{
System.out.println(rs.getString(2));
}

rs.close();
ps.close();
conn.close();
}
catch (Exception e)
{
e.printStackTrace();
}
}
}
希望对你有帮助

Answer 2

前三条
sql server数据库select top 3 * from student

Answer 3

java中写sql语言不能有*，必须要写出明确的要查询项。

Answer 4

select * from student