log4jdbc mysql jdbc_用log4jdbc发现性能问题

最新推荐文章于 2024-04-17 10:06:09 发布

原创最新推荐文章于 2024-04-17 10:06:09 发布 · 196 阅读

0 ·

CC 4.0 BY-SA版权

文章标签：

#log4jdbc mysql jdbc

通过对SQL日志的分析，发现了未检查用户登录状态导致的安全隐患。本文详细记录了具体的SQL查询语句，并探讨了如何避免此类问题的发生。

在sqltiming的log中看到有多处select xxx from xxx where xxx=xxx;的语句, 怀疑此处的逻辑有问题, 找到相应的code, 发现其原因为开发忘记加用户是否已登陆的逻辑

//格式为：响应时间请求时刻 sql

3 2013-03-21 13:18:52.790 SELECT COUNT(1) FROM GuideGrade WHERE guideId = 8605588 AND userEmail = 'ppppp2001@126.com'

1 2013-03-21 13:18:52.791 SELECT grade FROM GuideGrade WHERE guideId = 9321748 AND userEmail = '';

1 2013-03-21 13:18:52.792 UPDATE GuideGrade SET grade = 5, updateTime = '2013-03-21 13:18:52' WHERE guideId = 8585852 AND userEmail = 'dddd2001@163.com'

1 2013-03-21 13:18:52.793 UPDATE GuideGrade SET grade = 1, updateTime = '2013-03-21 13:18:52' WHERE guideId = 8605588 AND userEmail = 'ppppp2001@126.com'

1 2013-03-21 13:18:52.802 UPDATE GuideGrade SET grade = 4, updateTime = '2013-03-21 13:18:52' WHERE guideId = 8516797 AND userEmail = 'eeeeeeee@163.com'

21 2013-03-21 13:18:52.844 SELECT grade FROM GuideGrade WHERE guideId = 8814769 AND userEmail = '';

1 2013-03-21 13:18:52.853 SELECT grade FROM GuideGrade WHERE guideId = 9249748 AND userEmail = '';

1 2013-03-21 13:18:52.853 SELECT COUNT(1) FROM UserInfo WHERE userEmail='kkkkkkk@163.com'

0 2013-03-21 13:18:52.854 SELECT COUNT(1) FROM UserInfo WHERE userEmail='kkkkkkk@163.com'

0 2013-03-21 13:18:52.856 SELECT COUNT(1) FROM GuideGrade WHERE guideId = 8643419 AND userEmail = 'kkkkkkk@163.com'

1 2013-03-21 13:18:52.858 UPDATE GuideGrade SET grade = 3, updateTime = '2013-03-21 13:18:52' WHERE guideId = 8643419 AND userEmail = 'kkkkkkk@163.com'

11 2013-03-21 13:18:52.859 SELECT grade FROM GuideGrade WHERE guideId = 9335835 AND userEmail = '';

1 2013-03-21 13:18:52.880 SELECT grade FROM GuideGrade WHERE guideId = 9191890 AND userEmail = '';

2 2013-03-21 13:18:52.883 SELECT grade FROM GuideGrade WHERE guideId = 7653493 AND userEmail = '';

0 2013-03-21 13:18:52.929 SELECT grade FROM GuideGrade WHERE guideId = 8896489 AND userEmail = '';

1 2013-03-21 13:18:52.932 SELECT COUNT(1) FROM UserInfo WHERE userEmail='hhhhhhhhhhhh@163.com'