mybatis 如何定位sql injection violation, syntax error: ERROR. pos 998, line 14, column 41, token ON : 错误

当SQL语句在Navicat中正常运行,但在程序中出现异常时,问题可能源于SQL注入、语法错误或环境差异。通过错误信息中的pos和line定位到具体错误位置,例如pos998、line14,可以发现并修复问题。在Notepad++中检查和调整SQL语句,确保其在目标环境中正确执行。

摘要生成于 C知道 ,由 DeepSeek-R1 满血版支持, 前往体验 >

改SQL的时候如果遇到了这个问题,一般在navicat中能运行,但是在程序中就报错,这一类问题,难定位!

比如:遇到如下,

解析异常,e=查询异常,msg=数据查询失败,请检查sql语句是否准确  error : 
 Error querying database.  Cause: java.sql.SQLException: sql injection violation, syntax error: ERROR. pos 998, line 14, column 41, token ON : select

    b.UUID as "uuid",b.OPR_UUID as "oprUuid",b.SOURCE_ID as "sourceId",b.STS as "sts" ,
           g.ZS_SEQ_NO as "zsSeqNo",g.CREATE_TIME as "createTime",t.orsc_mno as "tranCorgNo",t.tran_dt as "tranDt",
           a.IN_MNO as "inMno",a.TRAN_ORG_DT as "tranOrgDt",a.ORDER_TYPE as "jftype",
           a.TRAN_ORG_UUID as "tranOrgUuid",a.TRAN_CRD_NO as "tranCrdNo",a.TRAN_ORG_AMT as "tranOrgAmt",
           g.AMT as "amt",b.AMT as "amt2",g.PROCESS_TYPE as "processType",
           b.DUTY_PARTY_TYP as "dutyPartyTyp",b.DUTY_PARTY_NO as "dutyPartyNo",b.DUTY_PARTY_NM as "dutyPartyNm",
           g.UPDATE_TIME as "updateTime",b.REMARK as "remark",if.MNO as "mno",a.SOURCE_TYPE as "sourceType"
        from DCM_OWNER.T_MBS_OPR_DTL  b 
        left join DCM_OWNER.T_MBS_ZS_IF g on b.SOURCE_ID=g.UUID
        left join DCM_OWNER.t_mbs_bm_order_if a on g.bm_uuid=a.uuid
        left join DCM_OWNER.t_pts_trandata t on t.uuid = a.source_id
        left join DCM_OWNER.t_mbs_opr_if c on c.uuid=b.opr_uuid
       left join DCM_OWNER.t_bap_mec_if if on if.in_mno=a.in_mno
           WHERE (a.SOURCE_TYPE = '1' or a.SOURCE_TYPE = '3')

复制代码:  从 select 开始复制, 如下示意

Error querying database.  Cause: java.sql.SQLException: sql injection violation, syntax error: ERROR. pos 998, line 14, column 41, token ON : select

复制到sql的最后, 把复制的sql 拷贝到 Notepad++ 编辑器中,鼠标定位到   pos 998, line 14, column 41,问题就是出在在这个地方.

 这个地方的 Pos 不一样.是因为上面的代码我是拷贝别人的. 我自己的试过了修复了问题,

{ "timestamp": "2023-07-14T11:17:15.188+0000", "status": 500, "error": "Internal Server Error", "message": "\r\n### Error querying database. Cause: java.sql.SQLException: sql injection violation, syntax error: syntax error, error in :'RDER BY province_id LIMIT 1', expect BY, actual BY pos 98, line 3, column 56, token BY : SELECT *\n FROM batch_control_line\n WHERE province_id = ? AND `year`=? LIMIT ORDER BY province_id LIMIT 1\r\n### The error may exist in mybatis/mapper/BatchControlLineMapper.xml\r\n### The error may involve com.college.collegesystem.dao.BatchControlLineMapper.findBatchControlLineByID\r\n### The error occurred while executing a query\r\n### SQL: SELECT * FROM batch_control_line WHERE province_id = ? AND `year`=? LIMIT ORDER BY province_id LIMIT 1\r\n### Cause: java.sql.SQLException: sql injection violation, syntax error: syntax error, error in :'RDER BY province_id LIMIT 1', expect BY, actual BY pos 98, line 3, column 56, token BY : SELECT *\n FROM batch_control_line\n WHERE province_id = ? AND `year`=? LIMIT ORDER BY province_id LIMIT 1\n; uncategorized SQLException; SQL state [null]; error code [0]; sql injection violation, syntax error: syntax error, error in :'RDER BY province_id LIMIT 1', expect BY, actual BY pos 98, line 3, column 56, token BY : SELECT *\n FROM batch_control_line\n WHERE province_id = ? AND `year`=? LIMIT ORDER BY province_id LIMIT 1; nested exception is java.sql.SQLException: sql injection violation, syntax error: syntax error, error in :'RDER BY province_id LIMIT 1', expect BY, actual BY pos 98, line 3, column 56, token BY : SELECT *\n FROM batch_control_line\n WHERE province_id = ? AND `year`=? LIMIT ORDER BY province_id LIMIT 1", "trace": "org.springframework.jdbc.UncategorizedSQLException: \r\n### Error querying database. Cause: java.sql.SQLException: sql injection violation, syntax error: syntax error, error in :'RDER BY province_id LIMIT 1', expect BY, actual BY pos 98, lin
07-15
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值