作者iFEELing (ing)
看板java
標題Re: [問題] 找不出nullpoint的問題點....
時間Sun Jun 6 20:34:22 2010
※ 引述《dream1124 (全新開始)》之銘言：
: 這邊是一個簡單的web程式
: jsp檔填表單，再送給servlet更改資料庫的檔案
: 但實作時一直產生nullPointerException 可是我檢查不出哪裡有null問題
: 請問有人方便幫我看一下嗎？
: 原始碼都不長，也都盡量寫成方法，請您放心
: 謝謝
: servlet原始碼︰http://docs.google.com/View?id=dcxxq5ff_26cfgs72gq
: jsp表單原始碼︰http://docs.google.com/View?id=dcxxq5ff_27cxk8wccq
我覺得這個servlet實在是很經典啊....
//empProfile是用來儲存輸入資料的javabean
package emp;
import javax.servlet.*;
import javax.servlet.http.*;
import java.io.*;
import java.sql.*;
import java.util.*;
public class modEmpServlet extends HttpServlet{
private Connection con;
private empProfile emp;
public modEmpServlet() {
}
public void doPost(HttpServletRequest req, HttpServletResponse res)
throws IOException, ServletException {
setConnection(out);
首先...out...這是啥? System.out ??
emp.setEmp_num( Integer.parseInt( req.getParameter("emp_num") ) );
emp.setEmp_name( req.getParameter("emp_num") );
emp.setEmp_phone( req.getParameter("emp_phone") );
emp.setEmp_address( req.getParameter("emp_address") );
emp.setStore_num( Integer.parseInt( req.getParameter("store_num") ) );
emp.setEmp_gender( req.getParameter("emp_gender") );
輸入之前 check 變數了嗎? 沒確認有沒有值就運算是會炸的喔
try {
String update = "UPDATE employeement SET EMP_NAME=" +
emp.getEmp_name()
+ ", EMP_PHONE=" + emp.getEmp_phone()
+ ", EMP_ADDRESS=" + emp.getEmp_address()
+ ", STORE_NUM=" + Integer.toString(
emp.getStore_num() )
+ ", EMP_GENDER=" + emp.getEmp_gender()
+ " WHERE EMP_NUM=" + Integer.toString(
emp.getEmp_num() );
Statement stmt = con.createStatement();
這邊是SQL Injection的基本案例...
stmt.executeUpdate(update);
execute 之後通常有個return值 你可以確認一下改到多少行
stmt.close();
con.close();
}//try
catch(SQLException sqle) {
然後 喔喔 把 Exception 吃的乾乾淨淨...這樣炸了就死無對證了
}//catch
}//doPost
public void doGet(HttpServletRequest req, HttpServletResponse res) throws
IOException, ServletException {
doPost(req, res);
}//doGet
public void setConnection(PrintWriter out) {
String classForName = "com.mysql.jdbc.Driver";
String url = "隱私問題, 不在google docs中公開";
String dbSchema = "不公開";
String user = "web_manager";
String pw = "web";
try{
Class.forName(classForName);
con = DriverManager.getConnection(url+dbSchema, user, pw);
}
catch(Exception sqle) {
這邊也是吃了 Exception 之後就假裝它不存在...
}//catch
}//setConnection()
}
--
And they... Will dance if they want to dance Please brother take a chance
You know they're gonna go Which way they wanna go
All we know is that we don't know
What is gonna be Please brother let it be
Life on the other hand won't let you understand
Why we're all part of the masterplan _
--
※ 發信站: 批踢踢實業坊(ptt.cc)
◆ From: 122.117.3.226
1F：推 superlubu:SQL Injection... 曾有 Contractor 被我用這玩了兩星期 06/06 20:38