java - 查询中的字符串参数

Question

我是一名程序员学习者。

我想获取以下格式的 MySQL 查询

 select status from training where status in ("Open", "Delivered")

来 self 的代码

if(params.openCheckBox){
    query +=" ( t.status  IN ("+params.openCheckBox+", "+params.DeliveredCheckBox+")" 
    query +=" )"
}

但是它给出了

   select status from training where status in (Open, Delivered)

这里是“”(缺少双引号)

Answer 1

用\转义双引号，MySQL接受双引号来包裹字符串。

query +=" ( t.status  IN (\""+params.openCheckBox+"\", \""+params.DeliveredCheckBox+"\")" 
query +=" )"

或者 只需使用单引号

query +=" ( t.status  IN ('"+params.openCheckBox+"', '"+params.DeliveredCheckBox+"')" 
query +=" )"

上面的查询存在 sql 注入(inject)漏洞。使用 PreparedStatement 如下所示

代码片段:

dbConnection = getDBConnection();
String query = "SELECT .... FROM .... WHERE t.status IN (?, ?)";
PreparedStatement preparedStatement = dbConnection.prepareStatement(query);
preparedStatement.setString(1, params.openCheckBox);
preparedStatement.setString(2, params.DeliveredCheckBox);
ResultSet rs = preparedStatement.executeQuery();

来源

• > PreparedStatement
• > JDBC PreparedStatement Example