ibatis order by 防止sql注入


(1) 排序控制

select TABLE_NAME, TABLESPACE_NAME from user_tables order by TABLE_NAME $ordertype$

Where the user input ordertype ASC, DESC. On this keyword, use the $ordertype: SQLKEYWORD$ replacement $ ordertype $.

(2)排序字段

sql statement metadata. If the sql statement, there is user input metadata. Table name, field names and so on.

For example the following sql:
select TABLE_NAME, TABLESPACE_NAME from user_tables order by $ orderByColumn $.

Which is the field in the database orderByColumn. Of this metadata, use: $ orderByColumn: METADATA $ replacement $ orderByColumn $.


免责声明!

本站转载的文章为个人学习借鉴使用,本站对版权不负任何法律责任。如果侵犯了您的隐私权益,请联系本站邮箱yoyou2525@163.com删除。



 
粤ICP备18138465号  © 2018-2025 CODEPRJ.COM