plan_order_status 表

insert into plan_order_status (PLAN_ORDER_STATUS_ID, PLAN_ORDER_STATUS_CONTENT)
values (1, '收藏夹');

insert into plan_order_status (PLAN_ORDER_STATUS_ID, PLAN_ORDER_STATUS_CONTENT)
values (2, '购物车');

insert into plan_order_status (PLAN_ORDER_STATUS_ID, PLAN_ORDER_STATUS_CONTENT)
values (3, '立即购买');

 

  • 0
    点赞
  • 0
    收藏
    觉得还不错? 一键收藏
  • 0
    评论
java.sql.SQLException: sql injection violation, syntax error: TODO : pos 872, line 15, column 43, token UNION : SELECT asewo.code_s as code,asewo.order_type_s as orderType,asewo.equipment_name_s as equipmentName,asewo.executor_s as executor, asewo.plan_start_time_T as planStartTime,asewo.plan_finish_time_T as planFinishTime,asewo.tpm_key_s as tpmKey,asewo.shop_s as shop, asewo.line_S as line,asewo.actual_start_time_t as startTime,asewo.actual_finish_time_t as finishTime,asewo.executor_account_s as executorAccounts, asewo.source_type_s as sourceType,asewo.SOURCE_ORDER_S as sourceOrder,asewo.CREATION_TIME as creationTime FROM AT_AS_EM_Work_Order asewo WHERE to_char(asewo.plan_start_time_T,'yyyy_mm-dd hh24:mi') <= to_char(plan_finish_time_T,'yyyy_mm_dd hh24:mi') AND asewo.ORDER_STATUS_S='创建' AND asewo.executor_s=? ORDER BY asewo.creation_time DESC Union All SELECT asewo.code_s as code,asewo.order_type_s as orderType,asewo.equipment_name_s as equipmentName,asewo.executor_s as executor, asewo.plan_start_time_T as planStartTime,asewo.plan_finish_time_T as planFinishTime,asewo.tpm_key_s as tpmKey,asewo.shop_s as shop, asewo.line_S as line,asewo.actual_start_time_t as startTime,asewo.actual_finish_time_t as finishTime,asewo.executor_account_s as executorAccounts, asewo.source_type_s as sourceType,asewo.SOURCE_ORDER_S as sourceOrder,asewo.CREATION_TIME as creationTime FROM AT_AS_EM_Work_Order asewo WHERE asewo.ORDER_STATUS_S='创建' AND asewo.executor_s=? ORDER BY asewo.creation_time DESC如何改
06-13
这段代码是一个SQL查询语句,其中包含了一个UNION操作符,因此可能存在SQL注入漏洞。如果要避免注入漏洞,可以使用参数化查询来构建SQL语句。具体来说,可以将查询中的变量使用占位符(如?)代替,然后在执行查询时将变量的值传递给占位符。这样可以确保输入的变量不会被当做SQL语句的一部分来解释,从而避免注入攻击。 以下是一个使用参数化查询的示例代码: ```java String sql = "SELECT asewo.code_s as code,asewo.order_type_s as orderType,asewo.equipment_name_s as equipmentName,asewo.executor_s as executor, " + "asewo.plan_start_time_T as planStartTime,asewo.plan_finish_time_T as planFinishTime,asewo.tpm_key_s as tpmKey,asewo.shop_s as shop, " + "asewo.line_S as line,asewo.actual_start_time_t as startTime,asewo.actual_finish_time_t as finishTime,asewo.executor_account_s as executorAccounts, " + "asewo.source_type_s as sourceType,asewo.SOURCE_ORDER_S as sourceOrder,asewo.CREATION_TIME as creationTime " + "FROM AT_AS_EM_Work_Order asewo " + "WHERE to_char(asewo.plan_start_time_T,'yyyy_mm-dd hh24:mi') <= to_char(plan_finish_time_T,'yyyy_mm_dd hh24:mi') " + "AND asewo.ORDER_STATUS_S='创建' " + "AND asewo.executor_s=? " + "ORDER BY asewo.creation_time DESC " + "UNION All " + "SELECT asewo.code_s as code,asewo.order_type_s as orderType,asewo.equipment_name_s as equipmentName,asewo.executor_s as executor, " + "asewo.plan_start_time_T as planStartTime,asewo.plan_finish_time_T as planFinishTime,asewo.tpm_key_s as tpmKey,asewo.shop_s as shop, " + "asewo.line_S as line,asewo.actual_start_time_t as startTime,asewo.actual_finish_time_t as finishTime,asewo.executor_account_s as executorAccounts, " + "asewo.source_type_s as sourceType,asewo.SOURCE_ORDER_S as sourceOrder,asewo.CREATION_TIME as creationTime " + "FROM AT_AS_EM_Work_Order asewo " + "WHERE asewo.ORDER_STATUS_S='创建' " + "AND asewo.executor_s=? " + "ORDER BY asewo.creation_time DESC"; PreparedStatement stmt = connection.prepareStatement(sql); stmt.setString(1, executor); stmt.setString(2, executor); ResultSet rs = stmt.executeQuery(); ``` 在上面的代码中,使用`PreparedStatement`来创建查询语句,并将占位符替换为变量。然后可以使用`setString`等方法来设置变量的值,最后执行查询并获取结果。通过使用参数化查询,可以有效地避免SQL注入漏洞。
评论
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值