验证用户 Mysql Java？

Question

我用这个开发做了这个查询但是我在接收 API 时遇到问题我尝试验证用户登录但总是 API RESPONSE LOGIN SUCCESS

我用 Java Spring Boot 和 Mysql 做了这个

这是我的代码：

@Override

public List<UserDto> getUsers() {

    List<UserDto> list = new ArrayList<UserDto>();

    try {

        Connection con = getConnection();

        PreparedStatement ps = con.prepareStatement("Select * from tableregister");

        ResultSet rs = ps.executeQuery();

        while (rs.next()) {

            UserDto data = new UserDto();

            data.setName(rs.getString("name"));

            data.setLastname(rs.getString("lastname"));

            data.setEmail(rs.getString("email"));

            data.setUsername(rs.getString("username"));

            data.setNumber(rs.getString("number"));

            data.setPassword(rs.getString("password"));

            list.add(data);

        }

    } catch (Exception e) {

        e.printStackTrace();

    }

    return list;

}

我先做了这个

@Override

public ApiResponseDto getlogin(UserDto usersLogin) {

  try{

       Connection con = getConnection();

       Statement st=con.createStatement();

       ResultSet rs=st.executeQuery("select * from tableregister where username='"+usersLogin.getUsername()+"' and password='"+usersLogin.getPassword()+"'");

       if (usersLogin.getUsername() != null && usersLogin.getPassword() != null) {

           return new ApiResponseDto("Success", "Login: ");

       } else {

           ApiResponseDto apiResponseDto = new ApiResponseDto("Error", "Error Login");

           apiResponseDto.setErrorCode(2);

           return apiResponseDto;

       }

   } catch (Exception e) {

       e.printStackTrace();

       return new ApiResponseDto("Error", "Error: " + e.toString());

   }

}

Answer 1

您分享的两个片段都是错误的。在第一个片段中，您执行了一个查询（顺便说一句，由于字符串连接，该查询容易受到 SQL 注入的攻击），但忽略其结果并仅检查作为参数传递的对象。在第二个片段中，您再次执行查询，但忽略结果，从数据库中获取所有用户，并检查他们是否存在。相反，您需要根据传递的参数进行查询，并检查查询是否返回了任何结果：@Overridepublic ApiResponseDto getlogin(UserDto usersLogin) {&nbsp; &nbsp; try {&nbsp; &nbsp; &nbsp; &nbsp; // Assumption: The connection is pooled, and doesn't require closing.&nbsp; &nbsp; &nbsp; &nbsp; Connection con = getConnection();&nbsp; &nbsp; &nbsp; &nbsp; try (Preparestament ps = con.preparestament("select * from tableregister where username = ? and password = ?") {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ps.setString(1, usersLogin.getUsername());&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ps.setString(2, userLoging.getPassword());&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; try (ResultSet rs = ps.executeQuery()) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; if (rs.next()) {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp;return new ApiResponseDto("Success", "Login Success");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; } else {&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; ApiResponseDto obj = new ApiResponseDto("Error", "Error Login");&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; obj.setErrorCode(1);&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; return obj;&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; &nbsp; &nbsp; }&nbsp; &nbsp; } catch (Exception e) {&nbsp; &nbsp; &nbsp; &nbsp; e.printStackTrace(); // Or log the error somehow&nbsp; &nbsp; &nbsp; &nbsp; return new ApiResponseDto("Error", "Error: " + e.toString());&nbsp; &nbsp; }}PS：请注意，在您的两个代码段中，您都没有正确关闭 JDBC 对象，从而导致泄漏。这可以使用 try-with-resource 语法相对巧妙地完成。

Answer 2

您需要检查结果集。您可以这样做。ResutSet rs = st.executeQuery....if(rs.next()) {&nbsp; String username = r.getUserName();&nbsp; ...}