非常感谢，下面是我的basedao，貌似没有错的，你看看 package com.scce.dao; import java.io.Serializable; import java.sql.*; import javax.servlet.jsp.jstl.sql.Result; import javax.servlet.jsp.jstl.sql.ResultSupport; public class BaseDAO impleme
非常感谢，下面是我的basedao，貌似没有错的，你看看
package com.scce.dao;
import java.io.Serializable;
import java.sql.*;
import javax.servlet.jsp.jstl.sql.Result;
import javax.servlet.jsp.jstl.sql.ResultSupport;
public class BaseDAO implements Serializable {
private static final String DRIVER = "com.microsoft.sqlserver.jdbc.SQLServerDriver";
private static final String URL = "jdbc:sqlserver://localhost:1433;databasename=GameCard_DB";
public static Connection getConnection() {
Connection con = null;
try {
Class.forName(DRIVER);
con = DriverManager.getConnection(URL, "sa", "scce");
} catch (Exception e) {
e.printStackTrace();
}
return con;
}
/**************************************************** 执行SQL语句 *********************************************************/
// 运行有结果集，无参数的sql语句
public static Result runSelectSql(String sql) {
Connection con = null;
PreparedStatement ps = null;
ResultSet res = null;
Result result = null;
try {
con = getConnection();
ps = con.prepareStatement(sql);
res = ps.executeQuery();
result = ResultSupport.toResult(res);
} catch (Exception e) {
e.printStackTrace();
} finally {
try {
res.close();
ps.close();
con.close();
} catch (Exception e) {
e.printStackTrace();
}
}
return result;
}
// 运行有结果集，有参数的sql语句
public static Result runSelectSql(String sql, Object[] params) {
Connection con = null;
PreparedStatement ps = null;
ResultSet res = null;
Result result = null;
try {
con = getConnection();
ps = con.prepareStatement(sql);
for (int i = 0; i ps.setObject(i + 1, params[i]);
}
res = ps.executeQuery();
result = ResultSupport.toResult(res);
} catch (Exception e) {
e.printStackTrace();
} finally {
try {
res.close();
ps.close();
con.close();
} catch (Exception e) {
e.printStackTrace();
}
}
return result;
}
// 运行无结果集，无参数的sql语句
public static boolean runUpdateSql(String sql) {
Connection con = null;
PreparedStatement ps = null;
try {
con = getConnection();
ps = con.prepareStatement(sql);
ps.executeUpdate();
return true;
} catch (Exception e) {
e.printStackTrace();
return false;
} finally {
try {
ps.close();
con.close();
} catch (Exception e) {
e.printStackTrace();
}
}
在原版的基础上做了一下修正：增加1st在线支付功能与论坛用户数据结合，vip也可与论坛相关，增加互动性vip会员的全面修正评论没有提交正文的问题特价商品的调用连接问题删掉了2个木马文件去掉了一个后门补了SQL注入补了一个过滤漏洞浮动价不能删除的问题不能够搜索问题收藏时放入购物车时出错点放入购物车弹出2个窗口修正定单不能删除问题VIP出错问题主题添加问题商家注册页导航连接问题添加了导航FLASH源文
}
// 运行无结果集，有参数的sql语句
public static boolean runUpdateSql(String sql, Object[] params) {
Connection con = null;
PreparedStatement ps = null;
try {
con = getConnection();
ps = con.prepareStatement(sql);
for (int i = 0; i ps.setObject(i + 1, params[i]);
}
ps.executeUpdate();
return true;
} catch (Exception e) {
e.printStackTrace();
return false;
} finally {
try {
ps.close();
con.close();
} catch (Exception e) {
e.printStackTrace();
}
}
}
/**************************************************** 执行存储过程语句 *********************************************************/
// 无结果集，无参数的存储过程
public static boolean runUpdateByProc(String procName) {
Connection con = null;
CallableStatement cs = null;
try {
con = getConnection();
String proc = String.format("{call %s()}", procName);
cs = con.prepareCall(proc);
return cs.executeUpdate() > 0;
} catch (Exception e) {
e.printStackTrace();
} finally {
try {
cs.close();
con.close();
} catch (Exception e) {
e.printStackTrace();
}
}
return false;
}
// 无结果集，有参数的存储过程
public static boolean runProcUpdate(String procName, Object[] params) {
Connection con = null;
CallableStatement cs = null;
try {
con = getConnection();
String proc = "{call " + procName + "(";
for (int i = 0; i proc += "?,";
}
proc = proc.substring(0, proc.length() - 1) + ")}";
cs = con.prepareCall(proc);
for (int i = 0; i // 说明是输入参数
if (params[i] != null) {
cs.setObject(i + 1, params[i]);
}
// 否则输出参数，就要注册
else {
// 第一个为位置，第二个为类型
cs.registerOutParameter(i + 1, java.sql.Types.VARCHAR);
}
}
cs.executeUpdate();// 只是执行了存储过程，但是还没有把执行赋给输出参数
for (int i = 0; i if (params[i] == null) { // 说明是输出参数
params[i] = cs.getObject(i + 1);
}
}
return true;
} catch (Exception e) {
e.printStackTrace();
return false;
} finally {
try {
cs.close();
con.close();
} catch (Exception e) {
e.printStackTrace();
}
}
}
// 有结果集，无参数的存储过程
public static Result runSelectByProc(String procName) {
Connection con = null;
ResultSet res = null;
Result result = null;
CallableStatement cs = null;
try {
con = getConnection();
String proc = String.format("{call %s}", procName);
cs = con.prepareCall(proc);
res = cs.executeQuery();
result = ResultSupport.toResult(res);
} catch (Exception e) {
e.printStackTrace();
} finally {
try {
res.close();
cs.close();
con.close();
} catch (Exception e) {
e.printStackTrace();
}
}
return result;
}
// 有结果集，有参数的存储过程
public static Result runSelectByProc(String procName, Object[] params) {
Connection con = null;
PreparedStatement ps = null;
ResultSet res = null;
Result result = null;
CallableStatement cs = null;
try {
con = getConnection();
String proc = "{call " + procName + "(";
for (int i = 0; i proc += "?,";
}
proc = proc.substring(0, proc.length() - 1) + ")}";
cs = con.prepareCall(proc);
for (int i = 0; i if (params[i] != null)
{
cs.setObject(i + 1, params[i]);
} else
{
cs.registerOutParameter(i + 1, java.sql.Types.VARCHAR);
}
}
res = cs.executeQuery();
result = ResultSupport.toResult(res);
for (int i = 0; i if (params[i] == null)
{
params[i] = cs.getObject(i + 1);
}
}
} catch (Exception e) {
e.printStackTrace();
} finally {
try {
cs.close();
con.close();
} catch (Exception e) {
e.printStackTrace();
}
}
return result;
}
}
