springboot mybatis 注解 sql 返回为 null

前面用 jpa 都是在属性上加注解 @Column(name=“name”),mybatis 不能这么用,所以要加上如下配置

mybatis:
  configuration:
    #配置项:开启下划线到驼峰的自动转换. 作用:将数据库字段根据驼峰规则自动注入到对象属性。
    map-underscore-to-camel-case: true

查询方法

@Mapper
public interface BrandMapper {
    @Select("select name from qs_brand where name = #{brandName})
    String findBrandName(@Param("brandName") String brandName);
}

mybatis 依赖

<dependency>
            <groupId>org.mybatis.spring.boot</groupId>
            <artifactId>mybatis-spring-boot-starter</artifactId>
            <version>2.1.0</version>
        </dependency>

参考:https://zhuanlan.zhihu.com/p/31015559

  • 0
    点赞
  • 2
    收藏
    觉得还不错? 一键收藏
  • 1
    评论
好的,下面是一个完整的Spring Boot防止SQL注入的过滤器示例: ```java import org.springframework.core.annotation.Order; import org.springframework.stereotype.Component; import org.springframework.util.StringUtils; import org.springframework.web.filter.OncePerRequestFilter; import javax.servlet.FilterChain; import javax.servlet.ServletException; import javax.servlet.http.HttpServletRequest; import javax.servlet.http.HttpServletRequestWrapper; import javax.servlet.http.HttpServletResponse; import java.io.IOException; import java.util.regex.Matcher; import java.util.regex.Pattern; @Component @Order(1) public class SqlInjectionFilter extends OncePerRequestFilter { private static final String SQL_REGEX = "(?i)(\\b(select|update|delete|insert|create|drop|alter|truncate|grant|revoke|backup|restore)\\b)|(\\b(and|or)\\b.+?(=|>|<|>=|<=|<>|!=|!<|!>)|\\b(in|like|regexp|sounds)\\b.+?\\()"; @Override protected void doFilterInternal(HttpServletRequest request, HttpServletResponse response, FilterChain filterChain) throws ServletException, IOException { String method = request.getMethod(); if ("GET".equals(method)) { String queryString = request.getQueryString(); if (!StringUtils.isEmpty(queryString)) { String filteredQuery = filter(queryString); request = new FilteredGetRequest(request, filteredQuery); } } else if ("POST".equals(method)) { String contentType = request.getContentType(); if (contentType != null && contentType.contains("application/x-www-form-urlencoded")) { String body = HttpHelper.getBodyString(request); if (!StringUtils.isEmpty(body)) { String filteredBody = filter(body); request = new FilteredPostRequest(request, filteredBody); } } } filterChain.doFilter(request, response); } private static String filter(String input) { Pattern pattern = Pattern.compile(SQL_REGEX); Matcher matcher = pattern.matcher(input); String filteredInput = matcher.replaceAll(""); return filteredInput; } private static class FilteredGetRequest extends HttpServletRequestWrapper { private String filteredQuery; public FilteredGetRequest(HttpServletRequest request, String filteredQuery) { super(request); this.filteredQuery = filteredQuery; } @Override public String getQueryString() { return filteredQuery; } } private static class FilteredPostRequest extends HttpServletRequestWrapper { private String filteredBody; public FilteredPostRequest(HttpServletRequest request, String filteredBody) { super(request); this.filteredBody = filteredBody; } @Override public String getParameter(String name) { String value = super.getParameter(name); if (value != null) { return filter(value); } return null; } @Override public String getHeader(String name) { String value = super.getHeader(name); if (value != null) { return filter(value); } return null; } @Override public ServletInputStream getInputStream() throws IOException { return new FilteredServletInputStream(super.getInputStream(), filteredBody); } @Override public BufferedReader getReader() throws IOException { return new BufferedReader(new FilteredStringReader(super.getReader(), filteredBody)); } private static class FilteredServletInputStream extends ServletInputStream { private InputStream inputStream; private String filteredBody; public FilteredServletInputStream(InputStream inputStream, String filteredBody) { this.inputStream = inputStream; this.filteredBody = filteredBody; } @Override public int read() throws IOException { return inputStream.read(); } @Override public boolean isFinished() { return false; } @Override public boolean isReady() { return false; } @Override public void setReadListener(ReadListener readListener) { } } private static class FilteredStringReader extends StringReader { private String filteredBody; public FilteredStringReader(Reader reader, String filteredBody) { super(filteredBody); this.filteredBody = filteredBody; } @Override public int read(char[] cbuf, int off, int len) throws IOException { return super.read(cbuf, off, len); } } } } ``` 在该过滤器中,首先判断请求的方法是GET还是POST,然后对请求参数进行过滤。 对于GET请求,可以通过`getQueryString`方法获取查询字符串并进行过滤,然后将过滤后的查询字符串封装到`FilteredGetRequest`类中,并将该封装后的请求对象传递给过滤器链中的下一个过滤器。 对于POST请求,需要判断请求的Content-Type是否为"application/x-www-form-urlencoded",如果是,则需要获取请求的Body并进行过滤,然后将过滤后的Body封装到`FilteredPostRequest`类中,并将该封装后的请求对象传递给过滤器链中的下一个过滤器。 在`filter`方法中,使用正则表达式对查询字符串或请求Body进行过滤,以防止SQL注入攻击。 需要注意的是,上述示例仅仅是一个简单的防止SQL注入的过滤器示例,实际情况下可能需要更加复杂的过滤逻辑。另外,在使用任何过滤器时,都需要仔细测试和验证,确保不会对系统产生不必要的影响。

“相关推荐”对你有帮助么?

  • 非常没帮助
  • 没帮助
  • 一般
  • 有帮助
  • 非常有帮助
提交
评论 1
添加红包

请填写红包祝福语或标题

红包个数最小为10个

红包金额最低5元

当前余额3.43前往充值 >
需支付:10.00
成就一亿技术人!
领取后你会自动成为博主和红包主的粉丝 规则
hope_wisdom
发出的红包
实付
使用余额支付
点击重新获取
扫码支付
钱包余额 0

抵扣说明:

1.余额是钱包充值的虚拟货币,按照1:1的比例进行支付金额的抵扣。
2.余额无法直接购买下载,可以购买VIP、付费专栏及课程。

余额充值