dao工厂和预防sql注入

内容简介：dao工厂和预防sql注入

1、配置文件 dao.properties

UserDao=cn.itcast.dao.impl.UserDaoJdbcImpl

2、 DaoFactory （工厂一般要做成单例的，这样工厂的对象在内存里只有一个。目的是希望所有dao由一个dao来生产）

package cn.itcast.factory;  import java.io.IOException; import java.io.InputStream; import java.util.Properties;  public class DaoFactory {     private Properties prop = new Properties();      private DaoFactory() {         InputStream in = DaoFactory.class.getClassLoader().getResourceAsStream("dao.properties");         try {             prop.load(in);         } catch (IOException e) {             throw new RuntimeException(e);         }     }      private static DaoFactory instance = new DaoFactory();      public static DaoFactory getInstance() {         return instance;     }      /*如果将来产生多个dao，就不能写死(泛型)      *比如当调用createDao方法时，会传一个,UserDao的接口，      * 然后根据名称解读配置文件dao.properties加载UserDao的实现类，new出对象返回      */     public <T> T createDao(Class<T> clazz) {          String name = clazz.getSimpleName();//得到接口名称         String className = prop.getProperty(name);         try {            T dao = (T) Class.forName(className).newInstance();            return dao;         } catch (Exception e) {             throw new RuntimeException(e);         }     }  }

3、自定义dao异常，dao层在写的时候，如果出问题了，抛出 RunTimeException 异常不太好，一般来说我们会自定义一个异常，好处就是到时候出问题看异常的类名就可以快速定位。

package cn.itcast.exception;  //运行时异常(抛出异常时希望上层处理就是编译时异常) public class DaoException extends RuntimeException {     public DaoException() {         super();     }      public DaoException(String message) {         super(message);     }      public DaoException(String message, Throwable cause) {         super(message, cause);     }      public DaoException(Throwable cause) {         super(cause);     } }

4、自定义异常后，在 UserDaoImpl 里就要将异常 RunTimeException 转为 DaoException

package cn.itcast.dao.impl;  import cn.itcast.dao.UserDao; import cn.itcast.domain.User; import cn.itcast.exception.DaoException; import cn.itcast.utils.JdbcUtils;  import java.sql.Connection; import java.sql.ResultSet; import java.sql.Statement;  //2 public class UserDaoJdbcImpl implements UserDao {     public void add(User user) {         Connection conn = null;         Statement st = null;         ResultSet rs = null;         try {             conn = JdbcUtils.getConnection();             st = conn.createStatement();             String sql = "insert into users(id,username,password,email,birthday,nickname) values('" + user.getId() + "','" + user.getUsername() + "','" + user.getPassword() + "','" + user.getEmail() + "','" + user.getBirthday().toLocaleString() + "','" + user.getNickname() + "')";             int num = st.executeUpdate(sql);             if (num < 1) {                 throw new RuntimeException("注册用户失败");             }         } catch (Exception e) {             throw new DaoException(e);//gosling  thinking in java  spring         } finally {             JdbcUtils.release(conn, st, rs);         }     }      public User find(String username, String password) {          Connection conn = null;         Statement st = null;         ResultSet rs = null;         try {             conn = JdbcUtils.getConnection();             st = conn.createStatement();             String sql = "select * from users where username='" + username + "' and password ='" + password + "'";             rs = st.executeQuery(sql);             if (rs.next()) {                 User user = new User();                 user.setId(rs.getString("id"));                 user.setUsername(rs.getString("username"));                 user.setPassword(rs.getString("password"));                 user.setEmail(rs.getString("email"));                 user.setBirthday(rs.getDate("birthday"));                 user.setNickname(rs.getString("nickname"));                 return user;             }             return null;         } catch (Exception e) {             throw new DaoException(e);         } finally {             JdbcUtils.release(conn, st, rs);         }     }      //查找注册的用户是否在数据库中存在     public boolean find(String username) {         Connection conn = null;         Statement st = null;         ResultSet rs = null;         try {             conn = JdbcUtils.getConnection();             st = conn.createStatement();             String sql = "select * from users where username='" + username + "'";             rs = st.executeQuery(sql);             if (rs.next()) {                 return true;             }             return false;         } catch (Exception e) {             throw new DaoException(e);         } finally {             JdbcUtils.release(conn, st, rs);         }     } }

5、防范 sql 注入攻击 UserDaoJdbcImpl （代码注释很全）

package cn.itcast.dao.impl;  import cn.itcast.dao.UserDao; import cn.itcast.domain.User; import cn.itcast.exception.DaoException; import cn.itcast.utils.JdbcUtils;  import java.sql.Connection; import java.sql.PreparedStatement; import java.sql.ResultSet; import java.sql.Statement;  //2 public class UserDaoJdbcImpl implements UserDao {     public void add(User user) {         Connection conn = null;         PreparedStatement ps = null;         ResultSet rs = null;         try {             conn = JdbcUtils.getConnection();             String sql = "insert into users(id,username,password,email,birthday,nickname) values(?,?,?,?,?,?)";             ps = conn.prepareStatement(sql);             ps.setString(1,user.getId());             ps.setString(2,user.getUsername());             ps.setString(3,user.getPassword());             ps.setString(4,user.getEmail());             ps.setDate(5,new java.sql.Date(user.getBirthday().getTime()));             ps.setString(6,user.getNickname());              int num = ps.executeUpdate();             if (num < 1) {                 throw new RuntimeException("注册用户失败");             }         } catch (Exception e) {             throw new DaoException(e);//gosling  thinking in java  spring         } finally {             JdbcUtils.release(conn, ps, rs);         }     }      /*      * Statement和PreparedStatement的区别      * PreparedStatement是Statement的孩子      * PreparedStatement可以防止sql注入的问题      * PreparedStatement会对sql语句进行预编译，减轻服务器的压力      */     public User find(String username, String password) {          Connection conn = null;         PreparedStatement ps = null;//PreparedStatement预防sql注入         ResultSet rs = null;         try {             conn = JdbcUtils.getConnection();             String sql = "select * from users where username=? and password =?";             ps = conn.prepareStatement(sql);//预编译这条sql语句             ps.setString(1,username);//数据库会对登录时拿到的内容进行转义             ps.setString(2,password);              rs = ps.executeQuery();             if (rs.next()) {                 User user = new User();                 user.setId(rs.getString("id"));                 user.setUsername(rs.getString("username"));                 user.setPassword(rs.getString("password"));                 user.setEmail(rs.getString("email"));                 user.setBirthday(rs.getDate("birthday"));                 user.setNickname(rs.getString("nickname"));                 return user;             }             return null;         } catch (Exception e) {             throw new DaoException(e);         } finally {             JdbcUtils.release(conn, ps, rs);         }     }      //查找注册的用户是否在数据库中存在     public boolean find(String username) {         Connection conn = null;         PreparedStatement ps = null;         ResultSet rs = null;         try {             conn = JdbcUtils.getConnection();             String sql = "select * from users where username=?";             ps = conn.prepareStatement(sql);             ps.setString(1,username);             rs = ps.executeQuery();             if (rs.next()) {                 return true;             }             return false;         } catch (Exception e) {             throw new DaoException(e);         } finally {             JdbcUtils.release(conn, ps, rs);         }     } }

源代码：https://github.com/yvettee36/Jdbc_User

以上就是本文的全部内容，希望本文的内容对大家的学习或者工作能带来一定的帮助，也希望大家多多支持 码农网

查看所有标签

猜你喜欢:

• Synode：自动化预防Node.js的注入攻击
• 内存泄漏预防与治理
• 测试自动化：预防还是治疗？
• 谈谈预防故障的性价比
• 如何检测及预防C++内存泄漏
• 有效预防黑客DDoS攻击的技巧

本站部分资源来源于网络，本站转载出于传递更多信息之目的，版权归原作者或者来源机构所有，如转载稿涉及版权问题，请联系我们。