使用Mybatis时由于粗心遇到Cause: java.sql.SQLException: sql injection violation异常

最新推荐文章于 2024-08-22 11:24:30 发布

笨鸟先飞的菜鸟

最新推荐文章于 2024-08-22 11:24:30 发布

阅读量2.6w

点赞数

分类专栏： Mybatis 异常记录文章标签： java

本文链接：https://blog.csdn.net/qsz1281509180/article/details/104912838

版权

使用Mybatis插入数据时，由于粗心书写错误导致出现Cause: java.sql.SQLException: sql injection violation异常，SQL语句如下：


 <insert id="insertProduct"
            parameterType="com.isoftstone.product.entity.ProductBean">
        insert into mmall_product
        (
        <include refid="baseInsertSql"/>
        )
        values (
          #{productId}, #{categoryId}, #{productName}, ${subtitle},
          #{mainImage}, #{subImages}, #{detail}, #{productPrice},
          #{stock}, #{status},
          <choose>
              <when test="createTime != null">
                  #{createTime},
              </when>
              <otherwise>
                  now(),
              </otherwise>
          </choose>
          <choose>
              <when test="updateTime != null">
                  #{updateTime}
              </when>
              <otherwise>
                  now()
              </otherwise>
          </choose>
        )
    </insert>

异常详细堆栈信息如下：

org.springframework.jdbc.UncategorizedSQLException: 
### Error updating database.  Cause: java.sql.SQLException: sql injection violation, syntax error: syntax error. pos 237, line 9, column 26, token IDENTIFIER phone : insert into mmall_product
        (
         
        id, category_id, name, subtitle, main_image, sub_images,
        detail, price, stock, status, create_time, update_time
     
        )
        values (
          ?, ?, ?, hello phone,
          ?, ?, ?, ?,
          ?, ?,
           
                  now(),
               
           
                  now()
               
        )
### SQL: insert into mmall_product         (                   id, category_id, name, subtitle, main_image, sub_images,         detail, price, stock, status, create_time, update_time               )         values (           ?, ?, ?, hello phone,           ?, ?, ?, ?,           ?, ?,                               now(),                                               now()                         )
### Cause: java.sql.SQLException: sql injection violation, syntax error: syntax error. pos 237, line 9, column 26, token IDENTIFIER phone : insert into mmall_product
        (
         
        id, category_id, name, subtitle, main_image, sub_images,
        detail, price, stock, status, create_time, update_time