PreparedStatement对象防止SQL注入-526互联

import utils.JdbcUtils;

import javax.imageio.plugins.jpeg.JPEGImageReadParam;
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.SQLException;

public class TestInsert {
public static void main(String[] args) {
Connection connection = null;
PreparedStatement st = null;
try {
connection = JdbcUtils.getConnection();
String sql = "insert into users(id,name,password,email,birthday)values(?,?,?,?,?)";//使用?占位符代替参数
st=connection.prepareStatement(sql);//预编译sql先写SQL不执行;
//设置参数
st.setInt(1,1001);
st.setString(2,"张三");
st.setString(3,"123456");
st.setString(4,"zhangsan@qq.com");
st.setDate(5,new java.sql.Date(new java.util.Date().getTime()));
//执行SQL
int i = st.executeUpdate();
if(i>0) {
System.out.println("插入成功");
}

} catch (SQLException e) {
e.printStackTrace();
}finally {
JdbcUtils.release(connection,st,null);
}

}
}