jdbc防止sql注入方法总结

String sql= "select * from users where username=? and password=?";    //如果把？改为:username1,按参数名绑定
        PreparedStatement preState = conn.prepareStatement(sql);
        preState.setString(1, userName);                         //则此处变为.setString("username1",username)
        preState.setString(2, password);
        ResultSet rs = preState.executeQuery();

for(String word : invalidsql){  
                if(word.equalsIgnoreCase(value) || value.contains(word)){  
                    if(value.contains("<")){  
                        value = value.replace("<", "<"); 　　　　//这个个人认为括号中第二个<应该替换成其他符号 
                    }  
                    if(value.contains(">")){  
                        value = value.replace(">", ">");  
                    }  
                    request.getSession().setAttribute("sqlInjectError", "the request parameter ""+value+"" contains keyword: ""+word+""");  
                    response.sendRedirect(request.getContextPath()+error);  
                    return;  
                }  
            }