jfianl sql 使用append 拼接，防sql注入

最新推荐文章于 2023-08-30 14:47:00 发布

weixin_30662849

最新推荐文章于 2023-08-30 14:47:00 发布

阅读量501

点赞数

文章标签： java

原文链接：http://www.cnblogs.com/phyxis/p/6502145.html

版权

  public Page<Channel> getChannelByPage(int pageNum, int pageSize, Map<String , String> paramMap){
        String sql = "SELECT * ";
        String orderBy = " ORDER BY id DESC";
        StringBuilder condition = new StringBuilder("");
        condition.append(" FROM tb_channel WHERE 1=1 ");

        List<Object> values = new ArrayList<Object>();

        if(StringUtils.isNotBlank(paramMap.get("channel_id"))){
            condition.append(" AND channel_id LIKE ?");
            values.add("'%"+paramMap.get("channel_id")+"%'" );
        }
        if(StringUtils.isNotBlank(paramMap.get("channel_name"))){
            condition.append(" AND channel_name LIKE ?");
            values.add("'%"+paramMap.get("channel_name")+"%'" );
        }
        Page<Channel> channel = super.paginate(pageNum, pageSize, sql, condition + orderBy,values.toArray() );
        return channel;
    }