防止sql注入 吓死人了

用ibatis  进行登录操作时sql查询居然范了个sql注入的大错 直接拼接的sql

 

public List userLogin(String username,String pwd){

String sql = "select username,pwd,user_type from T_MFF_USER_INFO "

+ " where username = '"+username+"'"

+ " and pwd = '" + pwd +"'";

List list = (List)this.get_select().selectObject("getUserInfo",sql);

return list;

}

 

登录后吓死我了拼接 pwd 输入  ' or '1'='1