Java中Mysql防止注入攻擊

String sql = "select * from users u where u.id = ? and u.password = ?";

preparedstatement ps = connection.preparestatement(sql);

ps.setint(1,id);

ps.setstring(2,pwd);

resultset rs = ps.executequery();

 

正則表達式過濾：

 

同時過濾它們的十六進制：

來自爲知筆記(Wiz)