SQL注入解决动态拼接where条件个数不固定

最新推荐文章于 2024-07-30 09:05:50 发布

星辰great

最新推荐文章于 2024-07-30 09:05:50 发布

阅读量3.5k

点赞数 4

分类专栏：漏洞文章标签： SQL注入动态拼接where条件个数不固定

本文链接：https://blog.csdn.net/qq_28219067/article/details/84346399

版权

漏洞专栏收录该内容

2 篇文章 0 订阅

订阅专栏

只需一个ArrayList

		String sqlWhere = "";
		List<String> paramList = new ArrayList<>();
		if(parone!= null && !parone.equals("")){
			sqlwhere +=" and parone like ? ";
			paramList.add("%"+parone+"%");
		}
		if(partwo!= null && !partwo.equals("")){
			sqlwhere +=" and partwolike ? ";
			paramList.add("%"+partwo+"%");
		}
		if(parThree!= null && !parThree.equals("")){
			sqlwhere +=" and parone like ? ";
			paramList.add("%"+parThree+"%");
		}
		
		String sqlcount="select count(*) as count from table where 1=1 "+sqlwhere; 
		ps =conn.prepareStatement(sqlcount);
		for (int i = 1; i < paramList.size()+1; i++) {
			ps.setString(i, paramList.get(i-1));
		}
		  rs = ps.executeQuery();