话不多说,直接进入主题
一:下面我们写个关于“#”的个sql,看能不能注入。
<select id="selectUser" resultMap="BaseResultMap">
SELECT
acc.user_name FROM dfws_sys_user_account AS acc
WHERE
acc.user_name like #{userName}
</select>
1.正常传参
DfwsSysUserAccount user = new DfwsSysUserAccount();
user.setUserName("wanglingzhi");
List<DfwsSysUserAccount> list = userAccountService.selectUser(user);
if(list!=null && list.size()>0){
for (DfwsSysUserAccount u:list) {
System.out.println("用户名:"+u.getUserName());
}
}else{
System.out.println("暂无数据");
}
sql打印:
Preparing: SELECT acc.user_name FROM dfws_sys_user_account AS acc WHERE acc.user_name = ?
Parameters: wanglingzhi(String)
2.拼接传参
DfwsSysUserAccount user = new DfwsSysUserAccount();
user.setUserName("'wanglingzhi' or acc.user_name = 'shuizhong'");
List<DfwsSysUserAccount> list = userAccountService.selectUser(user);
if(list!=null && list.size()>0){
for (DfwsSysUserAccount u:list) {
System.out.println("用户名:"+u.getUserName());
}
}else{
System.out.println("暂无数据");
}
sql打印:
Preparing: SELECT acc.user_name FROM dfws_sys_user_account AS acc WHERE acc.user_name = ?
Parameters: wanglingzhi or acc.user_name = shuizhong(String)
二:下面我们写个关于“$”的个sql,看能不能注入。
<select id="selectUser" resultMap="BaseResultMap">
SELECT
acc.user_name FROM dfws_sys_user_account AS acc
WHERE
acc.user_name like ${userName}
</select>
1.正常传参
DfwsSysUserAccount user = new DfwsSysUserAccount();
user.setUserName("'wanglingzhi'");
List<DfwsSysUserAccount> list = userAccountService.selectUser(user);
if(list!=null && list.size()>0){
for (DfwsSysUserAccount u:list) {
System.out.println("用户名:"+u.getUserName());
}
}else{
System.out.println("暂无数据");
}
打印sql:
SELECT acc.user_name FROM dfws_sys_user_account AS acc WHERE acc.user_name = 'wanglingzhi'
2.拼接传参
DfwsSysUserAccount user = new DfwsSysUserAccount();
user.setUserName("'wanglingzhi' or acc.user_name = 'shuizhong'");
List<DfwsSysUserAccount> list = userAccountService.selectUser(user);
if(list!=null && list.size()>0){
for (DfwsSysUserAccount u:list) {
System.out.println("用户名:"+u.getUserName());
}
}else{
System.out.println("暂无数据");
}
打印sql:
SELECT acc.user_name FROM dfws_sys_user_account AS acc WHERE acc.user_name = 'wanglingzhi' or acc.user_name = 'shuizhong'
很显然,这里已经sql注入了。
总结:
#{}
预编译SQL,类似于JAVA的预编译,例如:
String sql = "insert into info(name,age) values(?,?)";
PreparedStatement sta = con.prepareStatement(sql);
sta.setString(1, “张三”);
sta.setInt(2, 10);
只不过默认情况下会把参数当做字符串而自动添加一个双引号,例如:order by #id#,当传入的值是10时则为order by “10”。
凡是用到table、column名字的地方都不能用#,例如:insert into/select/delete/order by等这些后面是紧跟table名字和column名字的,这些名字是不允许添加引号的。
优点在于:防止SQL注入。
${}
不会预编译,原样输出,不会额外添加任何符号。例如:order by ${id},当传入的值是10时则为order by 10。
缺点:可能发生SQL注入问题。
原文:https://blog.csdn.net/qq_27811247/article/details/80775036
原文:https://blog.csdn.net/attack_breast/article/details/88039493