Java预防SQL注入的具体实践方法

String sql = "SELECT * FROM users WHERE username = ? AND password = ?";
try (Connection conn = dataSource.getConnection();
     PreparedStatement pstmt = conn.prepareStatement(sql)) {
    
    pstmt.setString(1, username); // 自动转义特殊字符（如 ' -> \'）
    pstmt.setString(2, password);
    
    try (ResultSet rs = pstmt.executeQuery()) {
        // 处理结果
    }
}

// 直接拼接 SQL（存在注入风险！）
String sql = "SELECT * FROM users WHERE username = '" + username + "'";
Statement stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(sql);

// 使用 Hibernate Criteria API
CriteriaBuilder cb = session.getCriteriaBuilder();
CriteriaQuery<User> query = cb.createQuery(User.class);
Root<User> root = query.from(User.class);

query.where(
    cb.equal(root.get("username"), username),
    cb.equal(root.get("password"), password)
);

User user = session.createQuery(query).uniqueResult();

String hql = "FROM User WHERE username = :username";
Query<User> query = session.createQuery(hql, User.class);
query.setParameter("username", username);
User user = query.uniqueResult();

// 校验用户名是否符合规则（仅允许字母、数字、下划线）
if (!username.matches("^[a-zA-Z0-9_]{4,20}$")) {
    throw new IllegalArgumentException("Invalid username");
}

// 使用 Apache Commons Text 转义
String safeInput = StringEscapeUtils.escapeSql(input); // 仅适用于简单场景，不推荐依赖！

// 动态表名校验（只允许预定义的合法表名）
Set<String> validTables = Set.of("users", "products");
if (!validTables.contains(tableName)) {
    throw new IllegalArgumentException("Invalid table name");
}
String sql = "SELECT * FROM " + tableName; // 此时拼接是安全的

try {
    // 执行数据库操作
} catch (SQLException e) {
    // 生产环境返回通用错误，避免泄露细节
    logger.error("Database error", e);
    throw new RuntimeException("Internal server error");
}