配套文档http://download.csdn.net/detail/u012102536/9799249
1 sql注入
String fileWid=RequestUtils.getParam(request,"fileWid");
String sql="select ywbh,ywwid,wjm from zc_ywfj where wid='"+fileWid+"' ";
CachedRowSet rs=new SQLDirect().exeQuery(sql);
String ywbh="",ywwid="",wjm="";
if(rs.next()){
ywbh=StringUtils.defaultIfEmpty(rs.getString("ywbh"),"");
ywwid=StringUtils.defaultIfEmpty(rs.getString("ywwid"),"");
wjm=StringUtils.defaultIfEmpty(rs.getString("wjm"),"");
}
2 <%=StringEscapeUtils.escapeJavaScript(wid) %>
3 queryForList 代替queryForMap
String getArticle="select bt,zz,nr,fbsj,wzxs from net_wz where zt='1' and wid=?";
List article=jt.queryForList(getArticle,new Object[]{wid});
String wzxs="";
Map articleMap=null;
if(article.size()>0){
for(int i=0;i<article.size();i++){
articleMap=(Map)article.get(i);
wzxs=StringUtil.getDataFromMap(articleMap,"wzxs");
}}else{
article=null;
wzxs="";
}