mybatis注解动态sql注入map和list方式(防sql注入攻击)

mybatis注解动态sql注入map和list方式(防sql注入攻击)

目录网上的教程我的教程(防sql注入攻击)注入Map注入List封装foreachmybatis防止sql注入的循环map写法

网上的教程

配置xml

注解中写xml脚本@Select()

使用java类中的Java方法拼写sql语句(不防sql注入攻击的纯字符串拼接)

我的教程(防sql注入攻击)

注入Map

Mapper层代码

@Repository

public interface ManageMapper {

@SelectProvider(type = ManageProvider.class, method = "queryDevices")

List

}

Service层代码

@Service("manageService")

public class ManageServiceImpl implements ManageService {

@Resource

private ManageMapper manageMapper;

@Override

public List

HashMap map = new HashMap<>();

map.put("1-1", "1800");

map.put("1-2", "1854");

return manageMapper.queryDevices(devicetypeno, map);

}

}

SqlProvider代码

public class ManageProvider {

public String queryDevices() {

String sql = new SQL()

.SELECT("TERMINALNUM, ORGCODE, DEVICETYPENO, DEVICENAME")

.FROM("S_DEVICE_INFO")

.WHERE("DEVICETYPENO = #{devicetypehttp://no}")

.WHERE("ORGCODE IN (#{map.1-1}, #{map.1-2})")

.toString();

return sql;

}

}

注入List

Mapper层代码

@Repository

public interface ManageMapper {

@SelectProvider(type = ManageProvider.class, method = "queryDevices")

List

}

Service层代码

@Service("manageService")

public class ManageServiceImpl implements ManageService {

@Resource

private ManageMapper manageMapper;

@Override

public List

ArrayList

list.add("1800");

list.add("1854");

return manageMapper.queryDevices(devicetypeno, list);

}

}

SqlProvider代码

public class ManageProvider {

public String queryDevices(Map params) {

// String sql = new SQL()

// .SELECT("TERMINALNUM, ORGCODE, DEVICETYPENO, DEVICENAME")

// .FROM("S_DEVICE_INFO")

// .WHERE("DEVICETYPENO = #{devicetypeno}")

// .WHERE("ORGCODE IN (#{list[0]}, #{list[1]})")

// .toString();

// return sql;

@SuppressWarnings("unchecked")

List

StringBuilder inBuilder = new StringBuilder();

for (int i = 0, size = list.size(); i < size; i++) {

if (i == 0) {

inBuilder.append("(").append("#{list[").append(i).append("]}");

} else if (i == size - 1) {

inBuilder.append(", ").append("#{list[").append(i).append("]}").append(")");

} else {

inBuilder.append(", ").append("#{list[").append(i).append("]}");

}

}

SQL sql = new SQL()

.SELECT("TERMINALNUM, ORGCODE, DEVICETYPENO, DEVICENAME")

.FROM("S_DEVICE_INFO")

.WHERE("DEVICETYPENO = #{devicetypeno}");

if (inBuilder.length() > 0) {

sql.WHERE("ORGCODE IN " + inBuilder);

}

return sql.toString();

}

}

封装foreach

像xml foreach标签一样使用foreach方法

请看mybatis注解动态sql中foreach工GrvgLtdJ具方法

mybatis防止sql注入的循环map写法

${k} = #{condition[${k}]}

版权声明：本文内容由网络用户投稿，版权归原作者所有，本站不拥有其著作权，亦不承担相应法律责任。如果您发现本站中有涉嫌抄袭或描述失实的内容，请联系我们jiasou666@gmail.com 处理，核实后本网站将在24小时内删除侵权内容。