String sql = "SELECT * FROM users WHERE username = ? AND password = ?";
try (Connection conn = dataSource.getConnection();
     PreparedStatement pstmt = conn.prepareStatement(sql)) {
    
    pstmt.setString(1, username); // 自動(dòng)轉(zhuǎn)義特殊字符（如 ' -> \'）
    pstmt.setString(2, password);
    
    try (ResultSet rs = pstmt.executeQuery()) {
        // 處理結(jié)果
    }
}

// 直接拼接 SQL（存在注入風(fēng)險(xiǎn)?。?
String sql = "SELECT * FROM users WHERE username = '" + username + "'";
Statement stmt = conn.createStatement();
ResultSet rs = stmt.executeQuery(sql);

// 使用 Hibernate Criteria API
CriteriaBuilder cb = session.getCriteriaBuilder();
CriteriaQuery<User> query = cb.createQuery(User.class);
Root<User> root = query.from(User.class);

query.where(
    cb.equal(root.get("username"), username),
    cb.equal(root.get("password"), password)
);

User user = session.createQuery(query).uniqueResult();

String hql = "FROM User WHERE username = :username";
Query<User> query = session.createQuery(hql, User.class);
query.setParameter("username", username);
User user = query.uniqueResult();

// 校驗(yàn)用戶(hù)名是否符合規(guī)則（僅允許字母、數(shù)字、下劃線）
if (!username.matches("^[a-zA-Z0-9_]{4,20}$")) {
    throw new IllegalArgumentException("Invalid username");
}

// 使用 Apache Commons Text 轉(zhuǎn)義
String safeInput = StringEscapeUtils.escapeSql(input); // 僅適用于簡(jiǎn)單場(chǎng)景，不推薦依賴(lài)！

// 動(dòng)態(tài)表名校驗(yàn)（只允許預(yù)定義的合法表名）
Set<String> validTables = Set.of("users", "products");
if (!validTables.contains(tableName)) {
    throw new IllegalArgumentException("Invalid table name");
}
String sql = "SELECT * FROM " + tableName; // 此時(shí)拼接是安全的

try {
    // 執(zhí)行數(shù)據(jù)庫(kù)操作
} catch (SQLException e) {
    // 生產(chǎn)環(huán)境返回通用錯(cuò)誤，避免泄露細(xì)節(jié)
    logger.error("Database error", e);
    throw new RuntimeException("Internal server error");
}