JDBC api学习笔记（四）——PreparedStatement预编译-CSDN博客PreparedStatemen

PreparedStatement

预编译

作用：预防Sql注入
【注意事项】真正的预编译功能需要手动开启，本方法只是预传入参数
模板代码

String user_name = "def";  
String user_password = "ddeeff";  

//4、定义Sql  
String sql = "SELECT * FROM user WHERE user_name = ? and user_password = ? ";  

//5、获取pstsm对象  
PreparedStatement pstmt = conn.prepareStatement(sql);  

//设置值  
pstmt.setString(1,user_name);//问号1，参数值  
pstmt.setString(2,user_password);//问号2，参数值  

//6、执行Sql  
ResultSet rs = pstmt.executeQuery();  

//7、处理结果  
if(rs.next()){  
    System.out.println("成功");  
}  
else {  
    System.out.println("失败");  
}