hibernate查询防止代码注入

  不要使用hql字符串组装,使用传递参数方式操作

  如

  Object[] obj = { "400", "' and 1=1 or 1='" };

  getHibernateTemplate().find("select new User(status) from user t where t.status=? and services=?",
        obj)

或者

getHibernateTemplate().executeFind(new HibernateCallback() {
   public Object doInHibernate(Session session)
     throws HibernateException, SQLException {

    String sql = "from User as model where name=:nameand password=:services";
    Query query = session.createQuery(sql);
    query.setParameter("name", "400");
    query.setParameter("password", "400");
    
    return query.list();
   }
  });