mysql - 动态表达式 Groovy SQL 的引用

Question

我正在使用 Groovy 对数据库进行查询，查询工作正常并返回正确的数据，但是我在终端中收到此错误。

In Groovy SQL please do not use quotes around dynamic expressions (which start with $) as this means we cannot use a JDBC PreparedStatement and so is a security hole. Groovy has worked around your mistake but the security hole is still there.

这是我的查询

sql.firstRow("""select elem
                        from site_content,
                        lateral jsonb_array_elements(content->'playersContainer'->'series') elem
                        where elem @> '{"id": "${id}"}'
                     """)

如果我将其更改为 $id 或

sql.firstRow("""select elem
                        from site_content,
                        lateral jsonb_array_elements(content->'playersContainer'->'series') elem
                        where elem @> '{"id": ?}'
                     """, id)

我收到以下错误

org.postgresql.util.PSQLException: The column index is out of range: 1, number of columns: 0.

Answer 1

位置或命名参数由groovy sql正确处理，应该使用而不是“'$id'”。

正如@Opal提到的和描述的here ，您应该将参数作为 list 或 map 传递:

sql.execute "select * from tbl where a=? and b=?", [ 'aa', 'bb' ]
sql.execute "select * from tbl where a=:first and b=:last", first: 'aa', last: 'bb'