jdbc預編譯實現方式

jdbc預編譯能夠有兩種方式：

方式1、jdbc本身實現的預編譯，就是作一下特殊字符處理來防SQL注入，看PreparedStatement源碼就能夠了。

public static void main(String[] args) {

    try {

        final String driverClassName = "com.mysql.jdbc.Driver";
        final String url = "jdbc:mysql://10.6.9.14:3306/SBLOG";  重點看這裏
        final String username = "sdl";
        final String password = "sdl";

        Connection connection = DriverManager.getConnection(url2, username, password);

        String sql = " SELECT *\n" +
                "   FROM t_web\n" +
                "  WHERE id = ? and name like ?";

        Class.forName(driverClassName);

        PreparedStatement preparedStatement = connection.prepareStatement(sql);

        preparedStatement.setInt(1, 1);

        preparedStatement.setString(2, "%ing%");


        ResultSet rst = preparedStatement.executeQuery();

        rst.next();

        System.out.println(rst.getString(2));
    } catch (Exception e) {
        e.printStackTrace();
    }

}

這裏是調用MySQL時的wireshark截圖。能夠看下實際上就是拼接完成的SQL發過去的。

 

 

 

方式2、利用MySQL的預編譯，。

 

public static void main(String[] args) {

    try {

        final String driverClassName = "com.mysql.jdbc.Driver";
        final String url2 = "jdbc:mysql://10.6.8.4:3306/SBLOG?useServerPrepStmts=true";  重點看這裏增長了useServerPrepStmts=true

        final String username = "sdl";
        final String password = "sdl";


        Connection connection = DriverManager.getConnection(url2, username, password);

        String sql = " SELECT *\n" +
                "   FROM t_web\n" +
                "  WHERE id = ? and name like ?";

        Class.forName(driverClassName);

        PreparedStatement preparedStatement = connection.prepareStatement(sql);

        preparedStatement.setInt(1, 1);

        preparedStatement.setString(2, "%ing%");


        ResultSet rst = preparedStatement.executeQuery();

        rst.next();

        System.out.println(rst.getString(2));
    } catch (Exception e) {
        e.printStackTrace();
    }

}

這裏是調用MySQL時的wireshark截圖。能夠看下實際上參數是用的佔位符?。

 

 

 

mybatis這種框架也是同樣。關鍵看你的jdbc url怎麼配置的，和框架不要緊。