sql注入 过滤_mybatis sql注入_sql注入攻击(2)

MAPPER :

<select id="exists" parameterType="java.util.HashMap" resultType="java.lang.Integer">
		SELECT COUNT(*) FROM USER user
		<where>
			<if test="code != null"> 
				and user.CODE = #{code} 
			</if>
			<if test="id != null"> 
				and user.ID = #{id} 
			</if>
			<if test="idList !=null ">
				and user.ID in (
				<foreach item="guard" index="index" collection="idList"
					separator=","> #{guard} </foreach>
				)
			</if>
		</where>
	</select>

MAP中有list或array时，foreach中的collection必须是具体list或array的变量名。mybatis sql注入比如这里MAP含有一个

名为idList的list，所以MAP中用idList取值，这点和单独传list或array时不太一样。

5. 传入JA对象

JA代码:

public boolean findUserListByDTO(UserDTO userDTO){
		Object count = getSqlSession().selectOne("com.liulanghan.exists", userDTO);
		int totalCount = Integer.parseInt(count.toString());
		return totalCount > 0 ? true : false;
	}

MAPPER :

<select id="findUserListByDTO" parameterType="UserDTO" resultType="java.lang.Integer">
		SELECT COUNT(*) FROM USER user
		<where>
			<if test="code != null"> 
				and user.CODE = #{code} 
			</if>
			<if test="id != null"> 
				and user.ID = #{id} 
			</if>
			<if test="idList !=null ">
				and user.ID in (
				<foreach item="guard" index="index" collection="idList"
					separator=","> #{guard} </foreach>
				)
			</if>
		</where>
	</select>

JA对象中有list或array时，foreach中的collection必须是具体list或array的变量名。比如这里UserDTO含有一个

本文来自电脑杂谈，转载请注明本文网址：
http://www.pc-fly.com/a/jisuanjixue/article-35320-2.html