Heibernate框架

<h6>HQL查询</h6>
Query query = session.createQuery("from Secret where username=?");
query.setParameter(0, username);
//Query query = session.createQuery("from Secret where username=:username");
<h6>使用PreparedStatement预编译</h6>
PreparedStatement updateSales = 
        conn.prepareStatement(" update goods set sales = ? where good_name like ?");
updateSales.setInt(1, 75);
updateSales.setString(2, "喜之郎果冻");
updateSales.executeUpdate();

Mybatis框架

核心:能用#就不用$

select * from news where tile like concat('%',#{title},'%')

ESAPI

<h6>Oracle</h6>
Codec oracleCodec = new OracleCodec();
String query = "select name from users where id = " + ESAPI.encoder().encoderForSQL(oracleCodec,userId);
Statement stmt = conn.createStatement(query);
<h6>MySQL</h6>
Codec mysqlCodec = new MySQLCodec(MySQLCodec.ANSI_MODE);

ANSI模式下,对单引号进行转义,对双引号进行过滤

private String encodeCharacterANSI(Character c){
    if(c == '\'')
        return "\'\'";
    if(c == '\"')
        return "";
    return "" + c;
}
Codec mysqlCodec = new MySQLCodec(MySQLCodec.MYSQL_MODE);

MYSQL模式通过在字符前面加反斜杠字符来进行转义

<h6>其它</h6>

ESAPI提供了OracleCodec,MySQLCodec, DB2Codec,[MSSQLCodec, PgSQLCodec],在使用时都是先实例化,再由ESAPI.encoder().encoderForSQL进行过滤/转义操作

点击收藏 | 0 关注 | 0
登录 后跟帖