java - 在 Java 中记录为用户语句

Question

*在登录页面中，用户输入用户名和密码并登录到主页。(使用 MySQL 数据库检查用户详细信息并验证数据)。

*在主页中，我想显示 Logged As : [Logged user name] 。我尝试了以下方法但没有成功。

 public void showUsername() throws SQLException{



    String sql1 = "SELECT username FROM logininfo WHERE username= '"+uname+"'" ;

    stmt = conn.createStatement();
    rs = stmt.executeQuery(sql1);

    while(rs.next()){
        String name=rs.getString("username");
        loggedUname_lbl.setText("You are Logged in as : "+name);
   }

*uname 是用户在登录页面中作为用户名给出的文本。

Answer 1

尝试使用准备好的语句并使用以下查询。如果表 logininfo 中有此用户名 (uname)，则应检索它。始终建议使用准备好的语句，它可以防止 SQL Injection

How does prepared statement prevent SQL Injection

        public void showUsername() throws SQLException{

    PreparedStatement pstmt = null;

            String sql1 = "SELECT username FROM logininfo WHERE username LIKE ?" ;
  // String sql1 = "SELECT username FROM logininfo WHERE username = ?" ;
//Use above  query for an exact match 

            pstmt = conn.prepareStatement(sql1);
            pstmt.setString(1,  "%" + uname + "%");
           // pstmt.setString(1, uname); Use this for the exact match query

            rs = pstmt.executeQuery(sql1);

            while(rs.next()){
                String name=rs.getString("username");
                loggedUname_lbl.setText("You are Logged in as : "+name);
           }
        }