go mysql 防止sql注入
//test.go
package main
import (
"database/sql"
"fmt"
_ "github.com/go-sql-driver/mysql"
"html/template"
"log"
"net/http"
"strings"
)
func login(w http.ResponseWriter, r *http.Request) {
fmt.Println("method:", r.Method) //获取请求的方法
if r.Method == "GET" {
t, _ := template.ParseFiles("D:/Golang/GoItem/go_ex/goSql/login.html")
t.Execute(w, nil)
} else {
//请求的是查询数据，那么执行查询的逻辑判断
r.ParseForm()
fmt.Println("username:", r.Form["username"])
var sename = strings.Join(r.Form["username"], "")
var partname = strings.Join(r.Form["password"], "")
db, err := sql.Open("mysql", "root:123456@/test?charset=utf8")
checkErr(err)
if sename != "" && partname != "" {
var uid int
var username string
var password string
//参数查询在一定程度上防止sql注入，参数化查询主要做了两件事:
//1.参数过滤；2.执行计划重用
//因为执行计划被重用，所以可以防止SQL注入。
err := db.QueryRow("SELECT * FROM userinfo WHERE username = ? AND password = ?", sename, partname).
Scan(&uid, &username, &password)
//判断返回的数据是否为空
if err == sql.ErrNoRows {
fmt.Fprintf(w, "无该用户数据")
} else {
if (sename == username) && (partname == password) {
fmt.Println(uid)
fmt.Println(username)
fmt.Println(password)
t, _ := template.ParseFiles("D:/Golang/GoItem/go_ex/goSQL/success.html")
t.Execute(w, nil)
}
}
} else if sename == "" || partname == "" {
fmt.Fprintf(w, "错误，输入不能为空！")
}
}
}
func checkErr(err error) {
if err != nil {
panic(err)
}
}
func main() {
http.HandleFunc("/login", login) //设置访问的路由
err := http.ListenAndServe(":9090", nil) //设置监听的端口
if err != nil {
log.Fatal("ListenAndServe: ", err)
}
}