mybatis 利用mysql盲注

 
               
//对应的mapperjava存在的地址
//对应的实体存在的地址,下面是它里面的字段

and ${criterion.condition}
and ${criterion.condition} #{criterion.value}
and ${criterion.condition} #{criterion.value} and #{criterion.secondValue}
and ${criterion.condition}
#{listItem}
and ${criterion.condition}
and ${criterion.condition} #{criterion.value}
and ${criterion.condition} #{criterion.value} and #{criterion.secondValue}
and ${criterion.condition}
#{listItem}
SYS_ID , OBJ_ID , OBJ_NAME , OBJ_DESCRIPTION , CREATOR , CREATE_TIME , UPDATE_OPERATOR , UPDATE_TIME , CLIENT_CHK_FLAG , CELL_PHONE , REG_EMAIL , GENDER , QQ_NO , WEB_URL

from T_ACNT

delete from T_ACNT
insert into T_ACNT ( OBJ_ID , OBJ_NAME , OBJ_DESCRIPTION , CREATOR , CREATE_TIME , UPDATE_OPERATOR , UPDATE_TIME , CLIENT_CHK_FLAG , CELL_PHONE , REG_EMAIL , GENDER , QQ_NO , WEB_URL )
values ( #{objId,jdbcType=VARCHAR} , #{objName,jdbcType=VARCHAR} , #{objDescription,jdbcType=VARCHAR} , #{creator,jdbcType=VARCHAR} , #{createTime,jdbcType=TIMESTAMP} , #{updateOperator,jdbcType=VARCHAR} , #{updateTime,jdbcType=TIMESTAMP} , #{clientChkFlag,jdbcType=DECIMAL} , #{cellPhone,jdbcType=VARCHAR} , #{regEmail,jdbcType=VARCHAR} , #{gender,jdbcType=DECIMAL} , #{qqNo,jdbcType=VARCHAR} , #{webUrl,jdbcType=VARCHAR} )
update T_ACNT
set OBJ_ID = #{record.objId,jdbcType=VARCHAR}
, OBJ_NAME = #{record.objName,jdbcType=VARCHAR}
, OBJ_DESCRIPTION = #{record.objDescription,jdbcType=VARCHAR}
, CREATOR = #{record.creator,jdbcType=VARCHAR}
, CREATE_TIME = #{record.createTime,jdbcType=TIMESTAMP}
, UPDATE_OPERATOR = #{record.updateOperator,jdbcType=VARCHAR}
, UPDATE_TIME = #{record.updateTime,jdbcType=TIMESTAMP}
, CLIENT_CHK_FLAG = #{record.clientChkFlag,jdbcType=DECIMAL}
, CELL_PHONE = #{record.cellPhone,jdbcType=VARCHAR}
, REG_EMAIL = #{record.regEmail,jdbcType=VARCHAR}
, GENDER = #{record.gender,jdbcType=DECIMAL}
, QQ_NO = #{record.qqNo,jdbcType=VARCHAR}
, WEB_URL = #{record.webUrl,jdbcType=VARCHAR}
update T_ACNT
OBJ_ID = #{objId,jdbcType=VARCHAR},
OBJ_NAME = #{objName,jdbcType=VARCHAR},
OBJ_DESCRIPTION = #{objDescription,jdbcType=VARCHAR},
CREATOR = #{creator,jdbcType=VARCHAR},
CREATE_TIME = #{createTime,jdbcType=TIMESTAMP},
UPDATE_OPERATOR = #{updateOperator,jdbcType=VARCHAR},
UPDATE_TIME = #{updateTime,jdbcType=TIMESTAMP},
CLIENT_CHK_FLAG = #{clientChkFlag,jdbcType=DECIMAL},
CELL_PHONE = #{cellPhone,jdbcType=VARCHAR},
REG_EMAIL = #{regEmail,jdbcType=VARCHAR},
GENDER = #{gender,jdbcType=DECIMAL},
QQ_NO = #{qqNo,jdbcType=VARCHAR},
WEB_URL = #{webUrl,jdbcType=VARCHAR},
where SYS_ID = #{sysId,jdbcType=DECIMAL}
吊儿郎当的钱袋

你可能感兴趣的:(学习过程)