sql命名参数注入

package com.piend.tongzhan.common.util;

import java.lang.reflect.Field;
import java.math.BigDecimal;
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.SQLException;
import java.util.Date;
import java.util.HashMap;
import java.util.Map;

public class SQLUtils {
	private PreparedStatement ps;
	private Map<Integer, String> indexMap = new HashMap<Integer, String>();

	public SQLUtils(Connection conn, String orgSql) {
		int n = 0, lastIndex = 0, index = 0;
		for (int i = 0; i < orgSql.length(); i++) {
			if (orgSql.charAt(i) == '#') {
				n++;
			}
			if (n % 2 == 0 && orgSql.charAt(i) == '#') {
				index++;
				this.indexMap.put(index, orgSql.substring(lastIndex + 1, i));
			}
			if (orgSql.charAt(i) == '#') {
				lastIndex = i;
			}
		}
		for (Integer i : this.indexMap.keySet()) {
			orgSql = orgSql.replace("#" + this.indexMap.get(i) + "#", "?");
		}
		try {
			System.out.println(orgSql);
			this.ps = conn.prepareStatement(orgSql);
		} catch (SQLException e) {
			e.printStackTrace();
		}

	}

	public PreparedStatement getPs() {
		return ps;
	}

	public Map<Integer, String> getIndexMap() {
		return indexMap;
	}

	public void setString(String name, String value) throws SQLException {
		try {
			for (Integer i : this.indexMap.keySet()) {
				if (name.equals(indexMap.get(i))) {
					ps.setString(i, value);
				}
			}
		} catch (SQLException e) {
			e.printStackTrace();
		}
	}

	public void setLong(String name, Long value) throws SQLException {
		try {
			for (Integer i : this.indexMap.keySet()) {
				if (name.equals(indexMap.get(i))) {
					ps.setLong(i, value);
				}
			}
		} catch (SQLException e) {
			e.printStackTrace();
		}
	}

	public void setDouble(String name, Double value) throws SQLException {
		try {
			for (Integer i : this.indexMap.keySet()) {
				if (name.equals(indexMap.get(i))) {
					ps.setDouble(i, value);
				}
			}
		} catch (SQLException e) {
			e.printStackTrace();
		}
	}

	public void setInt(String name, Integer value) throws SQLException {
		try {
			for (Integer i : this.indexMap.keySet()) {
				if (name.equals(indexMap.get(i))) {
					ps.setInt(i, value);
				}
			}
		} catch (SQLException e) {
			e.printStackTrace();
		}
	}

	public void setDate(String name, Date value) {
		try {
			for (Integer i : this.indexMap.keySet()) {
				if (name.equals(indexMap.get(i))) {
					ps.setDate(i, new java.sql.Date(value.getTime()));
				}
			}
		} catch (SQLException e) {
			e.printStackTrace();
		}
	}

	public void setBigDecimal(String name, BigDecimal value) {
		try {
			for (Integer i : this.indexMap.keySet()) {
				if (name.equals(indexMap.get(i))) {
					ps.setBigDecimal(i, value);
				}
			}
		} catch (SQLException e) {
			e.printStackTrace();
		}
	}

	public void setObject(String name, Object value) {
		try {
			for (Integer i : this.indexMap.keySet()) {
				if (name.equals(indexMap.get(i))) {
					ps.setObject(i, value);
				}
			}
		} catch (SQLException e) {
			e.printStackTrace();
		}
	}

	// 设置所有Map参数
	public void setAllMap(Map<String, Object> paraData) {
		try {
			for (Integer i : this.indexMap.keySet()) {
				for (String para : paraData.keySet()) {
					if (para.equals(indexMap.get(i))) {
						ps.setObject(i, paraData.get(para));
						break;
					}
				}
			}
		} catch (SQLException e) {
			e.printStackTrace();
		}
	}

	// 设置所有的javaBean
	public void setAllBean(Object bean) {
		Field fields[] = bean.getClass().getDeclaredFields();
		Field.setAccessible(fields, true);
		try {
			for (Integer i : this.indexMap.keySet()) {
				for (int j = 0; j < fields.length; j++) {
					if (fields[j].getName().equals(indexMap.get(i))) {
						ps.setObject(i, fields[j].get(bean));
						break;
					}
				}
			}
		} catch (IllegalArgumentException e) {
			e.printStackTrace();
		} catch (IllegalAccessException e) {
			e.printStackTrace();
		} catch (SQLException e) {
			e.printStackTrace();
		}
	}

	public static void main(String[] args) {
	}

}