MyBatis中sql注入_mybatis sql注入-优快云博客

本文链接：https://blog.youkuaiyun.com/qq_62965575/article/details/135095098

博客主要探讨了MyBatis中${}和#{}的区别，涉及SQL注入、底层实现、JDBC类型转换和单个简单类型参数等方面。${}不防止SQL注入，使用Statement，不进行类型转换；#{}可防止SQL注入，使用PreparedStatement，会进行类型转换。结论是除模糊匹配外，应杜绝使用${}。

摘要生成于 C知道，由 DeepSeek-R1 满血版支持，前往体验 >

1.在接口中写方法
User testLogin(User userInfo);

2.在配置文件中写sql
<select id="testLogin"  parameterType="com.by.pojo.User"  resultType="com.by.pojo.User">
    select  * from user where username='${username}' and password='${password}'
</select>

3.在测试类进行测试
private InputStream inputStream;
    private SqlSession sqlSession;
    @Before
    public void before() throws IOException {
        String rescource = "mybatis-config.xml";
        //加载配置文件
        inputStream =Resources.getResourceAsStream(rescource);
        //创建sqlSessionFactory
        SqlSessionFactory sqlSessionFactory=new SqlSessionFactoryBuilder().build(inputStream);
        //获得数据的会话实例
         sqlSession=sqlSessionFactory.openSession();
    }
/**
     * sql注入
     * @throws IOException
     */
    @Test
    public void testLogin()throws IOException {
        UserDao userDao = sqlSession.getMapper(UserDao.class);
        User userInfo=new User();
        userInfo.setUsername("张三丰");
        userInfo.setPassword("111");
        User  user = userDao.testLogin(userInfo);
        System.out.println(user);
    }

 @After
    public void close() throws IOException {
        /**
         * 关闭资源
         */
        sqlSession.close();
        inputStream.close();
    }

运行结果

1.在接口中写方法
User testLogin(User userInfo);

2.在配置文件中写sql
<select id="testLogin"  parameterType="com.by.pojo.User"  resultType="com.by.pojo.User">
    select  * from user where username='${username}' and password='${password}'
</select>

3.在测试类进行测试
private InputStream inputStream;
    private SqlSession sqlSession;
    @Before
    public void before() throws IOException {
        String rescource = "mybatis-config.xml";
        //加载配置文件
        inputStream =Resources.getResourceAsStream(rescource);
        //创建sqlSessionFactory
        SqlSessionFactory sqlSessionFactory=new SqlSessionFactoryBuilder().build(inputStream);
        //获得数据的会话实例
         sqlSession=sqlSessionFactory.openSession();
    }
/**
     * sql注入
     * @throws IOException
     */
    @Test
        public void testLogin()throws IOException {
        UserDao userDao = sqlSession.getMapper(UserDao.class);
        User userInfo=new User();
        userInfo.setUsername("张三丰 ' #");
        userInfo.setPassword("123");
        User  user = userDao.testLogin(userInfo);
        System.out.println(user);
    }

 @After
    public void close() throws IOException {
        /**
         * 关闭资源
         */
        sqlSession.close();
        inputStream.close();
    }

运行结果

1.在接口中写方法
User testLogin(User userInfo);

2.在配置文件中写sql
 <select id="testLogin"  parameterType="com.by.pojo.User"  resultType="com.by.pojo.User">
        select  * from user where username=#{username} and password=#{password}
</select>

3.在测试类进行测试
private InputStream inputStream;
    private SqlSession sqlSession;
    @Before
    public void before() throws IOException {
        String rescource = "mybatis-config.xml";
        //加载配置文件
        inputStream =Resources.getResourceAsStream(rescource);
        //创建sqlSessionFactory
        SqlSessionFactory sqlSessionFactory=new SqlSessionFactoryBuilder().build(inputStream);
        //获得数据的会话实例
         sqlSession=sqlSessionFactory.openSession();
    }
/**
     * sql注入
     * @throws IOException
     */
    @Test
        public void testLogin()throws IOException {
        UserDao userDao = sqlSession.getMapper(UserDao.class);
        User userInfo=new User();
        userInfo.setUsername("张三丰");
        userInfo.setPassword("111");
        User  user = userDao.testLogin(userInfo);
        System.out.println(user);
    }

 @After
    public void close() throws IOException {
        /**
         * 关闭资源
         */
        sqlSession.close();
        inputStream.close();
    }

运行结果

1.在接口中写方法
User testLogin(User userInfo);

2.在配置文件中写sql
 <select id="testLogin"  parameterType="com.by.pojo.User"  resultType="com.by.pojo.User">
        select  * from user where username=#{username} and password=#{password}
</select>

3.在测试类进行测试
private InputStream inputStream;
    private SqlSession sqlSession;
    @Before
    public void before() throws IOException {
        String rescource = "mybatis-config.xml";
        //加载配置文件
        inputStream =Resources.getResourceAsStream(rescource);
        //创建sqlSessionFactory
        SqlSessionFactory sqlSessionFactory=new SqlSessionFactoryBuilder().build(inputStream);
        //获得数据的会话实例
         sqlSession=sqlSessionFactory.openSession();
    }
/**
     * sql注入
     * @throws IOException
     */
    @Test
        public void testLogin()throws IOException {
        UserDao userDao = sqlSession.getMapper(UserDao.class);
        User userInfo=new User();
        userInfo.setUsername("张三丰 ' #");
        userInfo.setPassword("123");
        User  user = userDao.testLogin(userInfo);
        System.out.println(user);
    }

 @After
    public void close() throws IOException {
        /**
         * 关闭资源
         */
        sqlSession.close();
        inputStream.close();
    }

运行结果