ctjee 防SQL注入改造说明及设计原理

${name_key} ${%,userid,%}    like ${(,rolecode,)}   in 自动转换 页面变量及JSON格式数据为Key/Value格式存储缓存区 preparedStatementParameters  数据区 {rolecode=0aaa, _transName=查询baseRole单条明细根据主键, roledesc=0aaa, _transactionModeDB=, rolename=0aaa, _transferOptionId=baseRoleItemByPk.ext, dse_opflag=baseRoleItemByPk} ${(,rolecode,)}   in 删除 缓存区的数据格式     0aaa,0bbb op和dao中提供给2个方法，用于操作缓存区的数据 void setValueAtPreparedStatementParameters(String dataName, Object fieldValue); Object getValueAtPreparedStatementParameters(String dataName)； setValueAtPreparedStatementParameters("XXXXXXXX", XXXXXXXX); //分页例子--分页例子--分页例子--分页例子--分页例子--分页例子--分页例子--分页例子-- Update+Pre Map+Pre List+Pre StringBuffer totalCount = new StringBuffer( tUsersinfoSql.selectPageListCount_(_param,_map) );  ListPagePre(tUsersinfoSql.selectPageListBootstrapJqGrid_(_param,_map), totalCount.toString());  List _nList = (List)getValueAt("_nList"); --[selectDynamicSql]------------------------------------------------------------------------------------------ columnsValue += " "+entry.getKey()+"=${"+entry.getKey()+"} and";  setValueAtPreparedStatementParameters(entry.getKey(), entry.getValue()); in in in in in in in in in in in in in in in in in in in in in columnsValue += " "+entry.getKey()+" in ${(,"+entry.getKey()+",)} and";  setValueAtPreparedStatementParameters(entry.getKey(), entry.getValue()); ---[insertDynamicSql]------------------------------------------------------------------------------------------ values+="${"+entry.getKey()+"},"; setValueAtPreparedStatementParameters(entry.getKey(), entry.getValue()); --[updateDynamicSql]---------------------------------------------------------------------------------------------- columnsValue += ""+entry.getKey()+"=${"+entry.getKey()+"},"; setValueAtPreparedStatementParameters(entry.getKey(), entry.getValue()); ============================== whereValue += " "+entry.getKey()+"=${"+entry.getKey()+"} and"; setValueAtPreparedStatementParameters(entry.getKey(), entry.getValue()); in in in in in in in in in in in in in in in in in in in in in whereValue += " "+entry.getKey()+" in ${(,"+entry.getKey()+",)} and"; setValueAtPreparedStatementParameters(entry.getKey(), entry.getValue()); --------------------------------------------------------------------------------------------------------------------- --[deleteDynamicSql]---------------------------------------------------------------------------------------------- columnsValue += " "+entry.getKey()+"=${"+entry.getKey()+"} and";  setValueAtPreparedStatementParameters(entry.getKey(), entry.getValue()); in in in in in in in in in in in in in in in in in in in in in whereValue += " "+entry.getKey()+" in ${(,"+entry.getKey()+",)} and"; setValueAtPreparedStatementParameters(entry.getKey(), entry.getValue());

参考

http://ctjee.com/index.htmlhttp://ctjee.com/index.html