02 SQL注入问题

package JDBC;
import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.Statement;
public class login {
    public String login(String aname,String apass){
        String result = "用户名或密码错误";
        String classname = "com.mysql.jdbc.Driver";
        String url = "";
        String username = "";
        String password = "";
        try {
            Class.forName(classname);
            Connection conn = DriverManager.getConnection(url, username, password);
            Statement stat = conn.createStatement();
            String sql = "select * from atm where aname='"+aname+"'and apass='"+apass+"'";
            ResultSet rs = stat.executeQuery(sql);
            if (rs.next()){
                result = "登陆成功";
            }
            System.out.println("执行成功");
            stat.close();
            conn.close();
        } catch (Exception e) {
            e.printStackTrace();
        }
        return result;
    }
}

package JDBC;
import java.util.Scanner;
public class Testlogin {
    public static void main(String[] args) {
        Scanner input = new Scanner(System.in);
        System.out.println("请输入账号:");
        String aname = input.nextLine();
        System.out.println("请输入密码:");
        String apass = input.nextLine();
        login lg = new login();
        String rs = lg.login(aname, apass);
        if (rs.equals("登陆成功")){
            System.out.println("欢迎登陆银行系统");
        }else{
            System.out.println(rs);
        }
    }
}

在控制台执行命令可以发现使用xxx’ or ‘1’ = ‘1 也可以成功的登陆———>SQL注入
什么是SQL注入
通过SQL命令，拼接其他的字符串，让其他的字符串来改变原有SQL语句的执行，最终达到欺骗服务器的效果，里面拼接的字符符合SQL语法(被SQL语法认可)
解决办法
1.利用PreparedStatement

package JDBC;
import java.sql.*;
public class login {
    public String login(String aname,String apass){
        String result = "用户名或密码错误";
        String classname = "com.mysql.jdbc.Driver";
        String url = "jdbc:mysql://bj-cdb-547s28hs.sql.tencentcdb.com:60439/test?useSSL=true";
        String username = "root";
        String password = "qq2653650997";
        String sql = "select * from atm where aname=? and apass = ?";
        try {
            Class.forName(classname);
            Connection conn = DriverManager.getConnection(url, username, password);
            PreparedStatement pstat = conn.prepareStatement(sql);
            // 给问号赋值
            pstat.setString(1,aname);
            pstat.setString(2,apass);
            ResultSet rs = pstat.executeQuery();
            if (rs.next()){
                return "登陆成功";
            }
            System.out.println("执行成功");
            pstat.close();
            conn.close();
        } catch (Exception e) {
            e.printStackTrace();
        }
        return result;
    }
}