sql语法检测

最新推荐文章于 2025-04-01 09:47:31 发布

为爱停留

最新推荐文章于 2025-04-01 09:47:31 发布

阅读量5.5k

点赞数

分类专栏： java 文章标签： sql java 数据库

本文链接：https://blog.csdn.net/beiduofen2011/article/details/125017434

版权

java 专栏收录该内容

124 篇文章

订阅专栏

maven配置：

        <dependency>
            <groupId>com.github.jsqlparser</groupId>
            <artifactId>jsqlparser</artifactId>
            <version>4.2</version>
        </dependency>

用 jsqlparser可以限定输入哪种DML sql语句，如只限定select查询语句，用执行计划可以校验sql语法错误，如下：

    public SqlCheckRspVo sqlCheck(SqlCheckReqVo sqlCheckReqVo) {
        SqlCheckRspVo sqlCheckRspVo = new SqlCheckRspVo();
        if(!sqlCheckReqVo.getSql().contains("$")){
           return new SqlCheckRspVo(false,"sql中没有添加$");
        }
        sqlCheckReqVo.setSql(sqlCheckReqVo.getSql().trim());
        if(sqlCheckReqVo.getSql().endsWith(";")){
            sqlCheckReqVo.setSql(sqlCheckReqVo.getSql().substring(0,sqlCheckReqVo.getSql().length()-1));
        }
        for(AddReqVo.TableInfo tableInfo : sqlCheckReqVo.getRuleTables()) {
            String sql = sqlCheckReqVo.getSql().replace("$",tableInfo.getTableName());
            sqlCheckRspVo = sqlparse(sql);
            if(sqlCheckRspVo.getCheckResult() == false){
                return  sqlCheckRspVo;
            }
            SqlSession sqlSession = null;
            PreparedStatement pst ;
            try {
                sqlSession = getNativeSqlSession();
                Connection dbCon = sqlSession.getConnection();
                pst = dbCon.prepareStatement("explain plan for " +sql);
                pst.executeUpdate();
                pst.close();
            } catch (SQLException e) {
                sqlCheckRspVo.setCheckResult(false);
                sqlCheckRspVo.setErrorLog(ExceptionUtils.getStackTrace(e));
                return  sqlCheckRspVo;
            } finally {
                if (null != sqlSession) {
                    closeNativeSqlSession(sqlSession);
                }
            }
        }
        return  sqlCheckRspVo;
    }

    public SqlCheckRspVo sqlparse(String sqlContent){
        SqlCheckRspVo sqlCheckRspVo = new SqlCheckRspVo();
        try {
            Statement parse = CCJSqlParserUtil.parse(sqlContent);
            if(parse instanceof Select){
                sqlCheckRspVo.setCheckResult(true);
            }else{
                sqlCheckRspVo.setCheckResult(false);
                sqlCheckRspVo.setErrorLog("只能输入select语句");
            }
        }catch (Exception e){
            sqlCheckRspVo.setCheckResult(false);
            sqlCheckRspVo.setErrorLog(ExceptionUtils.getStackTrace(e));
        }
        return sqlCheckRspVo;
    }