微信开发中三种防注入的查询方法

String mobile="15136566978";

实体类查询写法一：

String query="from UserEntity where mobile=:mobile and name=:tjm";
Query queryObject = this.systemService.getSession().createQuery(query);
queryObject.setParameter("mobile",mobile);
queryObject.setParameter("name","张三" );
List<UserEntity> userlist = queryObject.list();

实体类查询写法二：

String hql="from UserEntity where  name=?";
Query query1 = this.systemService.getSession().createQuery(hql);
query1.setString(0,"张三" );
List<UserEntity> userlist1 = query1.list();

sql查询一：

String sql="select * from weixin_user where name=? ";
List list = this.systemService.findForJdbc(sql, "张三");