logindao.java

来自「MVC最容易学习的例子」· Java 代码 · 共 99 行

package com.tingsun.mvc.dao;

import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.Statement;

public class LoginDAO {
	public boolean login_2(String username,String password){
		CommDAO dao = new CommDAO();
		Connection conn= null;
		Statement stmt=null;
		ResultSet rs=null;
		boolean isLogin = false;
		try{
		conn = dao.getConn();
		stmt = conn.createStatement();
		
		String sql = " select ACCOUNT,PASSWORD,NAME,sex from student where ACCOUNT='"+username+"'";
		rs= stmt.executeQuery(sql);
		if(rs.next()){
			String pass=rs.getString("PASSWORD");
			if(null!=password&&password.equals(pass)){
				isLogin=true;
			}else{
				isLogin=false;
			}
		}else{
			isLogin=false;
		}
		
		}catch(Exception  e){
			e.printStackTrace();
		}finally{
			dao.closeConn(conn, stmt, rs);
		}
		return isLogin;	
	}
	
	public boolean login(String username,String password){
		CommDAO dao = new CommDAO();
		Connection conn= null;
		PreparedStatement psmt=null;
		ResultSet rs=null;
		boolean isLogin = false;
		try{
		conn = dao.getConn();
		
		String sql = " select ACCOUNT,PASSWORD,NAME,sex from student where ACCOUNT=?";
		psmt=conn.prepareStatement(sql);
		psmt.setString(1, username);
		
		rs= psmt.executeQuery();
//		rs= stmt.executeQuery(sql);
		if(rs.next()){
			String pass=rs.getString("PASSWORD");
			if(null!=password&&password.equals(pass)){
				isLogin=true;
			}else{
				isLogin=false;
			}
		}else{
			isLogin=false;
		}
		
		}catch(Exception  e){
			e.printStackTrace();
		}finally{
			//dao.closeConn(conn, stmt, rs);
		}
		return isLogin;	
	}	
//下面代码容易被黑客SQL注入　侵入系统	
	public boolean login_old(String username,String password){
		CommDAO dao = new CommDAO();
		Connection conn= null;
		Statement stmt=null;
		ResultSet rs=null;
		boolean isLogin = false;
		try{
		conn = dao.getConn();
		stmt = conn.createStatement();
		String sql = " select ACCOUNT,PASSWORD,NAME,sex from student where ACCOUNT='"+username+" and password='"+password+"'";
		rs= stmt.executeQuery(sql);
		if(rs.next()){
			isLogin=true;
		}else{
			isLogin=false;
		}
		
		}catch(Exception  e){
			e.printStackTrace();
		}finally{
			dao.closeConn(conn, stmt, rs);
		}
		return isLogin;	
	}	
}