public void list() {
//条件查询
StringBuffer sb = new StringBuffer();
if (!isParaBlank("order_number")){ //订单号
String value = DesUtil.stripTags(getPara("order_number"));
sb.append(" and a.order_number like '%"+value+"%'");
}
if(!isParaBlank("status")){ // 0待提交样品/1取消订单/2已分配/3订单已经完成
String value = DesUtil.stripTags(getPara("status"));
sb.append(" and status = '"+value+"'");
}
if(!isParaBlank("equipment_id")){ // 仪器
String value = DesUtil.stripTags(getPara("equipment_id"));
sb.append(" and b.equipment_id = '"+value+"'");
}
if(!isParaBlank("custom_name")){ //送检人
String value = DesUtil.stripTags(getPara("custom_name"));
sb.append(" and a.custom_name like '%"+value+"%'");
}
if(!isParaBlank("start_time")){ //预约时间
String value = DesUtil.stripTags(getPara("start_time"));
sb.append(" and apponintment_time >= '"+value+"'");
}
if(!isParaBlank("end_time")){ //预约时间
String value = DesUtil.stripTags(getPara("end_time"));
sb.append(" and apponintment_time <= dateadd(second,-1,dateadd(day,1,'"+value+"'))");
}
if(!isParaBlank("start_time1")){ //期望完成时间
String value = DesUtil.stripTags(getPara("start_time1"));
sb.append(" and expected_time >= '"+value+"'");
}
if(!isParaBlank("end_time1")){ //期望完成时间
String value = DesUtil.stripTags(getPara("end_time1"));
sb.append(" and expected_time <= dateadd(second,-1,dateadd(day,1,'"+value+"'))");
}
Page<Orders> page = ordersService.paginate3(getParaToInt("page"), getParaToInt("limit"),sb);//
我这是一个条件查询的分页 怎么改下代码防止sql注入
1.增加SQL代码可读性
2.占位符可以预先编译，提高执行效率
3.防止SQL注入
4.用占位符的目的是绑定变量，这样可以减少数据SQL的硬解析，所以执行效率会提高不少
1. 查询参数无通配符
String userId = getPara("userId");
User.dao.find("select * from t_er_user where userId = ?", userId);
2. 参数有通配符
String userName = this.getPara("userName");
Object [] para = new Object[]{"%" + userName + "%"};
User.dao.find("select * from t_er_user where userName like ?", para);
3. 多个参数，其中有参数需要添加通配符
String userId = this.getPara("userId");
String userName = this.getPara("userName");
Object [] para = new Object[]{userId, "%" + userName + "%"};
User.dao.find("select * from t_er_user where userId = ？ and userName like ?", para);