MyBatis+MySQL 传入参数

最新推荐文章于 2024-03-05 22:02:03 发布

原创最新推荐文章于 2024-03-05 22:02:03 发布 · 905 阅读

1 ·

CC 4.0 BY-SA版权

dev_Mybatis 专栏收录该内容

3 篇文章

订阅专栏

本文深入探讨了SQL参数注入技术，包括如何通过不同的方法传入参数以避免SQL注入攻击，具体涉及字符串参数、Map集合参数、数组参数、Java对象参数、Json对象参数等多种传参方式及其实现细节。

1.String 单独传参

public List<Teacher> selectTeacher(@Param(value="id") String id,@Param(value="sex") String sex);

2，Mapper位置传参数

#{0}

#{1}

3，Map出入参数

java：

Map<String,Object> par = new HashMap<>();
par.put("userId",userId);
par.put("orderSn",orderSn);
return marketCommentDao.getCommentByUid(par);

xml：

4，传入数组参数

@RequestMapping(value = "/applyJob", method = RequestMethod.POST,consumes = "application/json")
@ResponseBody
public DataTransferObject applyJob(@RequestBody Integer[] jobIds,HttpServletRequest request) {
Integer userId = SessionUtil.getUserId(request);
return jobProxy.applyJob(jobIds,userId);
}

5，java对象中mappr属性传参

java中的代码
private Map<String, Object> params = new HashMap<String, Object>();

xml中代码

<if test="params != null">
<if test="params.get('excludeId') != null">
or n.id = ${params.get('excludeId')}
</if>
</if>

6，JsonObject传入参数

java代码：

@RequestMapping(value = "/page",method = RequestMethod.POST)
@ResponseBody
public DataTransferObject page(@RequestBody JSONObject param){

java取参数： int pageNo = Integer.valueOf(param.get("pageNo").toString());
int pageSize = Integer.valueOf(param.get("pageSize").toString());

String content = param.optString("content", ""); //推荐
Integer result = param.optInt("result", 0); //推荐

java设置参数：

param.put("start", pageNo * pageSize);
param.put("end", pageSize);

java：判断，取出数组，移除

if (param.has("attributeItemIds")) {
JSONArray attributeItemIds = param.getJSONArray("attributeItemIds");
if (null == attributeItemIds || attributeItemIds.size() == 0) {
param.remove("attributeItemIds");
}
}

entityQO对象传递：

private Integer attributeId;

private JSONArray attributeItemIds;// 兼容web端

xml取出：

1， <select id="phoneListCommodityCompleteInfo" resultType="com.uei.phone.manager.model.market.CommodityVo" parameterType="com.uei.phone.manager.model.market.CommodityQo" >

2， <select id="listCmomodityCompleteInfo" resultType="hashMap" parameterType="org.json.simple.JSONObject" >

取出与遍历

<if test="catagoryId != null and catagoryId != ''">
AND b.catagory_id = #{catagoryId}
</if>
<if test="catagoryIds != null and catagoryIds.size != 0">
AND b.catagory_id IN
<foreach item="catagoryId" index="index" collection="catagoryIds" open="(" separator="," close=")">
#{catagoryId}
</foreach>
</if>