insert_infodao.java

本方案是在与***信息技术（北京）有限公司相关人员协商并分析了北京****投资有限公司综合信息管理系统（以下简称“**管理系统”）相关资料之后提交的网络安全解决方案。 本方案描述***管理系统的网络

			Statement stat = conn.createStatement();
			Iterator<UserBean> i = users.iterator();
			while (i.hasNext()) {
				UserBean user = i.next();
				stat
						.executeUpdate("update insert_info set state=1 where pk_id="
								+ user.getPk_id());
			}
			stat.close();
		} catch (SQLException e) {
			e.printStackTrace();
			throw new RuntimeException("更新state失败，请重试");
		} finally {
			this.closeConnection();
		}

	}

	/**
	 * 查看用户信息的操作
	 */
	public String showInfo(String sql) {

		return sql;
	}

	/**
	 * hxq 更新权限by User_id
	 */
	public int fillRoleByUser_id(RoleBean role, String sqlText) {
		try {
			System.out.println("Insert_infoDAO");

			conn = this.getConnection();

			PreparedStatement ps = conn.prepareStatement(sqlText);

			int state_pwf = RoleGet.UpdateRole_pwf(role);
			int state_lb = RoleGet.UpdateRole_lb(role);
			// System.out.println("Insert_infoDAO:" + permission + "__rolename:"
			// + role.getUsername());
			ps.setInt(1, state_pwf);
			ps.setInt(2, state_lb);
			// 用户名
			ps.setString(3, role.getUsername());
			ps.executeUpdate();
			ps.close();
		} catch (SQLException e) {
			e.printStackTrace();
			throw new RuntimeException("填充用户信息失败");
		} finally {

			this.closeConnection();
		}
		return 1;
	}

	/**
	 * 防止注入攻击
	 * 
	 * @param role
	 *            要保存的用户
	 * @param sqlText
	 *            sql字符串
	 * @reutrn 返回该用户的role_id，如果出错，则返回-1
	 */
	public int ChangeState(RoleBean role, String sqlText) {
		try {
			conn = this.getConnection();
			PreparedStatement ps = conn.prepareStatement(sqlText);
			ps.setInt(1, role.getSignstate());
			ps.setString(2, role.getUsername());
			ps.executeUpdate();

			ResultSet rs = ps.getGeneratedKeys();
			int role_id = -1;
			if (rs.next()) {
				role_id = rs.getInt(1);
				role.setUser_id(role_id);
			}
			if (rs.next()) {
				role.setUsername(rs.getString(1));
				role.setSignstate(rs.getInt(2));

			}
			rs.close();
			ps.close();
			return role_id;
		} catch (SQLException e) {
			e.printStackTrace();
			try {
				this.conn.rollback();
				throw new RuntimeException("插入用户失败，请重试");
			} catch (SQLException e1) {
				e1.printStackTrace();
				throw new RuntimeException("回滚出错");
			}
		} finally {
			this.closeConnection();
		}
	}

	/**
	 * hxq 获得 管理员的 状态 激活/注销
	 */
	public int selectState(RoleBean role, String sqlText) {
		try {
			conn = this.getConnection();
			conn.setAutoCommit(false);
			PreparedStatement ps = conn.prepareStatement(sqlText);
			// System.out.println("当前用户"+role.getUsername());
			ps.setString(1, role.getUsername());

			// System.out.println("Insert_infoDAO_selectState");
			ResultSet rs = ps.executeQuery();

			int state = 1;

			if (rs.next()) {

				System.out.println("状态：" + rs.getInt(1) + "(0-激活状态   1-注销状态)");
				state = rs.getInt(1);
				// role.setSignstate(state);
			}
			conn.commit();
			rs.close();
			ps.close();
			this.conn.setAutoCommit(true);

			return state;
		} catch (SQLException e) {
			e.printStackTrace();
			try {
				conn.rollback();
				this.conn.setAutoCommit(true);
				throw new RuntimeException("插入用户失败，请重试");
			} catch (SQLException e1) {
				e1.printStackTrace();
				throw new RuntimeException("回滚出错");
			}
		} finally {
			this.closeConnection();
		}
	}

	/**
	 * 更新 管理员 状态的方法 hxq
	 * 
	 * @param sqlText
	 *            更新字符串sql
	 */
	public void update_signState(LoginBean login, String sqlText) {
		try {
			conn = this.getConnection();
			PreparedStatement stat = conn.prepareStatement(sqlText);
			// System.out.println("update——signSate：" + login.getSignstate());
			stat.setInt(1, login.getSignstate());
			stat.setString(2, login.getUsername());
			stat.executeUpdate();
			stat.close();
		} catch (SQLException e) {
			e.printStackTrace();
			throw new RuntimeException("数据更新失败，请重试");
		} finally {
			this.closeConnection();
		}
	}

	/**
	 * 获得 管理员状态 的方法 hxq
	 * 
	 * @param sqlText
	 *            更新字符串sql
	 */
	public int select_signState(LoginBean login, String sqlText) {
		try {
			int signState = 1;
			conn = this.getConnection();
			PreparedStatement stat = conn.prepareStatement(sqlText);
			stat.setString(1, login.getUsername());
			ResultSet rs = stat.executeQuery();
			if (rs.next()) {
				// System.out.println(rs.getInt(1));
				signState = rs.getInt(1);
				// role.setSignstate(state);
			}
			stat.close();
			return signState;
		} catch (SQLException e) {
			e.printStackTrace();
			throw new RuntimeException("数据更新失败，请重试");
		} finally {
			this.closeConnection();
		}
	}

	/**
	 * 删除管理员的类 hxq
	 * 
	 * @param sqlText
	 *            更新字符串
	 */
	public void del_manager(RoleBean role, String sqlText) {
		try {

			conn = this.getConnection();
			PreparedStatement stat = conn.prepareStatement(sqlText);
			stat.setString(1, role.getUsername());

			stat.executeUpdate();

			stat.close();

		} catch (SQLException e) {
			e.printStackTrace();
			throw new RuntimeException("数据更新失败，请重试");
		} finally {
			this.closeConnection();
		}
	}

	/**
	 * 增加管理员的类 hxq
	 * 
	 * @param sqlText
	 *            更新字符串
	 */
	public void add_userinfo(RoleBean role, String sqlText) {
		try {

			conn = this.getConnection();
			PreparedStatement stat = conn.prepareStatement(sqlText);
			stat.setString(1, role.getUsername());
			stat.setString(2, role.getPassword());
			stat.setInt(3, 1);
			stat.executeUpdate();

			stat.close();

		} catch (SQLException e) {
			e.printStackTrace();
			throw new RuntimeException("数据更新失败，请重试");
		} finally {
			this.closeConnection();
		}
	}

	/**
	 * 增加管理员信息
	 * 
	 * @param role
	 * @param sqlText
	 */

	public void add_roleinfo(RoleBean role, String sqlText) {
		try {
			System.out.println("add_roleinfo:" + role.getUser_id());
			System.out.println("add_permission:" + role.getPermission());
			conn = this.getConnection();
			PreparedStatement stat = conn.prepareStatement(sqlText);
			stat.setInt(1, role.getUser_id());
			stat.setString(2, role.getState());
			stat.setString(3, role.getState_pwf());
			stat.setString(4, role.getState_lb());
			stat.setString(5, role.getPermission());

			stat.executeUpdate();

			stat.close();

		} catch (SQLException e) {
			e.printStackTrace();
			throw new RuntimeException("数据更新失败，请重试");
		} finally {
			this.closeConnection();
		}
	}

	/**
	 * 增加管理员 获得管理员id
	 * 
	 * @param role
	 * @param sqlText
	 * @return
	 */

	public int select_userid(RoleBean role, String sqlText) {
		// TODO Auto-generated method stub
		int uesr_id = 0;
		try {

			conn = this.getConnection();
			PreparedStatement stat = conn.prepareStatement(sqlText);
			stat.setString(1, role.getUsername());

			ResultSet rs = stat.executeQuery();

			if (rs.next()) {

				uesr_id = rs.getInt(1);

			}
			stat.close();
			return uesr_id;

		} catch (SQLException e) {
			e.printStackTrace();
			throw new RuntimeException("数据更新失败，请重试");
		} finally {
			this.closeConnection();
		}

	}
}