jdbcTemplate动态查询且防止sql注入实现

使用jdbcTemplate.update(sql, array);

防止sql注入

public Object updateCarGroup(CarGroupInfo carGroupInfo) {

		try {
			List param = new ArrayList<>();
			String sql = "UPDATE car_group_manage  SET ";
			if (carGroupInfo.getBgroupId() != null && !carGroupInfo.getBgroupId().equals("")) {

				sql += "bgroup_id= ? ";
				param.add(carGroupInfo.getBgroupId());
			}
			if (carGroupInfo.getName() != null && !carGroupInfo.getName().equals("")) {
				sql += ",name= ? ";
				param.add(carGroupInfo.getName());
			}
			if (carGroupInfo.getWorkArea() != null) {
				sql += ",work_area= ? ";
				param.add(carGroupInfo.getWorkArea());
			}
			if (carGroupInfo.getOwnArea() != null && 0 != carGroupInfo.getOwnArea()) {
				sql += ",own_area= ? ";
				param.add(carGroupInfo.getOwnArea());
			}
			sql += ",update_time=now() where id=?";

			param.add(carGroupInfo.getId());
			Object[] array = param.toArray(new Object[param.size()]);
			jdbcTemplate.update(sql, array);
		} catch (Exception e) {
			return new RRException(RongRunErrorCodeEnum.SYSTEM_ERROR).getCodeMsg();
		}

		return new RRException(RongRunErrorCodeEnum.SUCCESS).getCodeMsg();
	} 
  

 

你可能感兴趣的:(jdbc,jdbc)