不要使用hql字符串组装,使用传递参数方式操作
如
Object[] obj = { "400", "' and 1=1 or 1='" };
getHibernateTemplate().find("select new User(status) from user t where t.status=? and services=?",
obj)
或者
getHibernateTemplate().executeFind(new HibernateCallback() {
public Object doInHibernate(Session session)
throws HibernateException, SQLException {
String sql = "from User as model where name=:nameand password=:services";
Query query = session.createQuery(sql);
query.setParameter("name", "400");
query.setParameter("password", "400");
return query.list();
}
});