Question

java如何防止sql注入

Answer 1

采用预编译语句集，它内置了处理SQL注入的能力，只要使用它的setString方法传值即可： String sql= "select * from users where username=?; PreparedStatement preState = conn.prepareStatement(sql); preState.setString(1, userName); preState.setString(2, password); ResultSet rs = preState.executeQuery();