【发布时间】：2015-10-21 09:13:07
【问题描述】：
我已经为用户创建了一个登录环境，我已经从数据库中检索了用户名和密码以进行登录。并将用户名设置为会话中的字符串。现在我想为另一个 servlet 使用相同的用户名。但是我不能在两个 servlet 中使用相同的字符串。如何为另一个 servlet 使用相同的会话属性。下面是我的代码。
loginservlet
import java.io.IOException;
import java.io.PrintWriter;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.*;
import javax.servlet.*;
import javax.servlet.http.*;
import java.sql.*;
@WebServlet(urlPatterns = {"/LoginServlet"})
public class LoginServlet extends HttpServlet {
String userid, pwd;
protected void doPost(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
response.setContentType("text/html;charset=UTF-8");
PrintWriter out = response.getWriter();
Connection connection = null;
Statement statement = null;
userid = request.getParameter("uname");
pwd = request.getParameter("pass");
try {
dbconnector dbc = new dbconnector();
connection = dbc.Open();
PreparedStatement ps = connection.prepareStatement("select * from member where uname='" + userid + "' and pass='" + pwd + "'");
ResultSet rs = ps.executeQuery();
if (rs.next()) {
HttpSession session = request.getSession();
session.setAttribute("userid", userid);
//out.println("welcome " + userid);
//out.println("<a href='logout.jsp'>Log out</a>");
response.sendRedirect("success.jsp");
} else {
request.setAttribute("errorMessage", "Invalid user or password");
RequestDispatcher rd = getServletContext().getRequestDispatcher("/index.jsp");
rd.include(request, response);
}
} catch (Exception e) {
e.printStackTrace();
}
}
}
profile servlet这里我要使用会话值userid
import java.io.IOException;
import java.io.PrintWriter;
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.Statement;
import javax.servlet.RequestDispatcher;
import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import javax.servlet.http.HttpSession;
@WebServlet(urlPatterns = {"/usesesvaluegetdbdata"})
public class usesesvaluegetdbdata extends HttpServlet {
protected void processRequest(HttpServletRequest request, HttpServletResponse response)
throws ServletException, IOException {
response.setContentType("text/html;charset=UTF-8");
PrintWriter out = response.getWriter();
Connection connection = null;
Statement statement = null;
String userid;
try {
dbconnector dbc = new dbconnector();
connection = dbc.Open();
PreparedStatement ps = connection.prepareStatement("select eid,ename from member where uname='" + userid + "' and pass='" + pwd + "'");
} catch (Exception e) {
e.printStackTrace();
}
}
【问题讨论】：
-
session.getAttribute("userid")怎么样？ -
提示：当您顽固地直接在 SQL 字符串中字符串连接查询参数而不是使用 PreparedStatement 类的特殊 setXxx() 方法时，PreparedStatement 无法防止 SQL 注入攻击。
-
关于你的具体问题，“但我不能在两个servlet中使用相同的字符串”，能否请您详细说明“不能”？即没有技术限制，所以这一定是用户/开发人员的限制，但你没有详细说明。