org.springframework.jdbc.UncategorizedSQLException: sql injection violation, syntax error: ERROR

本文探讨了在使用Spring框架进行数据库操作时遇到的SQL注入冲突及语法错误问题,具体表现为控制台报告的UncategorizedSQLException异常,原因在于SQL语句中多余的逗号导致的语法错误。文章详细分析了错误的原因,并提供了修正SQL语句的方法。

摘要生成于 C知道 ,由 DeepSeek-R1 满血版支持, 前往体验 >

org.springframework.jdbc.UncategorizedSQLException:
Error updating database. Cause: java.sql.SQLException: sql injection violation, syntax error: ERROR. pos 152, line 2, column 24, token COMMA :

 insert into jxempprizeleadersetting 
 (`type`,`level`,`prizeLevel`,`groupPoint`,`personalPoint`,`unit`,`departmentId`,`parentId`) 
 values(?,?,?,?,?,?,?,,?)

SQL: insert into jxempprizeleadersetting (type,level,prizeLevel,groupPoint,personalPoint,unit,departmentId,parentId) values(?,?,?,?,?,?,?,,?)

上面是控制台报的错误,阅读上面的内容可以发现sql语句中多了一个逗号,如values(?,?,?,?,?,?,?,,?),检查sql语句发现真的是values里面多了一个逗号,引起的注入冲突。

{ "timestamp": "2023-07-14T11:17:15.188+0000", "status": 500, "error": "Internal Server Error", "message": "\r\n### Error querying database. Cause: java.sql.SQLException: sql injection violation, syntax error: syntax error, error in :'RDER BY province_id LIMIT 1', expect BY, actual BY pos 98, line 3, column 56, token BY : SELECT *\n FROM batch_control_line\n WHERE province_id = ? AND `year`=? LIMIT ORDER BY province_id LIMIT 1\r\n### The error may exist in mybatis/mapper/BatchControlLineMapper.xml\r\n### The error may involve com.college.collegesystem.dao.BatchControlLineMapper.findBatchControlLineByID\r\n### The error occurred while executing a query\r\n### SQL: SELECT * FROM batch_control_line WHERE province_id = ? AND `year`=? LIMIT ORDER BY province_id LIMIT 1\r\n### Cause: java.sql.SQLException: sql injection violation, syntax error: syntax error, error in :'RDER BY province_id LIMIT 1', expect BY, actual BY pos 98, line 3, column 56, token BY : SELECT *\n FROM batch_control_line\n WHERE province_id = ? AND `year`=? LIMIT ORDER BY province_id LIMIT 1\n; uncategorized SQLException; SQL state [null]; error code [0]; sql injection violation, syntax error: syntax error, error in :'RDER BY province_id LIMIT 1', expect BY, actual BY pos 98, line 3, column 56, token BY : SELECT *\n FROM batch_control_line\n WHERE province_id = ? AND `year`=? LIMIT ORDER BY province_id LIMIT 1; nested exception is java.sql.SQLException: sql injection violation, syntax error: syntax error, error in :'RDER BY province_id LIMIT 1', expect BY, actual BY pos 98, line 3, column 56, token BY : SELECT *\n FROM batch_control_line\n WHERE province_id = ? AND `year`=? LIMIT ORDER BY province_id LIMIT 1", "trace": "org.springframework.jdbc.UncategorizedSQLException: \r\n### Error querying database. Cause: java.sql.SQLException: sql injection violation, syntax error: syntax error, error in :'RDER BY province_id LIMIT 1', expect BY, actual BY pos 98, lin
07-15
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值