<span style="font-family:Comic Sans MS;font-size:12px;"><?xml version="1.0" encoding="UTF-8"?> <!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd"> <mapper namespace="com.test.dao.TAcntMapper"> <resultMap id="BaseResultMap" type="com.test.entity.TAcnt"> <id column="SYS_ID" jdbcType="DECIMAL" property="sysId" /> <result column="OBJ_ID" jdbcType="VARCHAR" property="objId" /> <result column="OBJ_NAME" jdbcType="VARCHAR" property="objName" /> <result column="OBJ_DESCRIPTION" jdbcType="VARCHAR" property="objDescription" /> <result column="CREATOR" jdbcType="VARCHAR" property="creator" /> <result column="CREATE_TIME" jdbcType="TIMESTAMP" property="createTime" /> <result column="UPDATE_OPERATOR" jdbcType="VARCHAR" property="updateOperator" /> <result column="UPDATE_TIME" jdbcType="TIMESTAMP" property="updateTime" /> <result column="CLIENT_CHK_FLAG" jdbcType="DECIMAL" property="clientChkFlag" /> <result column="CELL_PHONE" jdbcType="VARCHAR" property="cellPhone" /> <result column="REG_EMAIL" jdbcType="VARCHAR" property="regEmail" /> <result column="GENDER" jdbcType="DECIMAL" property="gender" /> <result column="QQ_NO" jdbcType="VARCHAR" property="qqNo" /> <result column="WEB_URL" jdbcType="VARCHAR" property="webUrl" /> </resultMap> <sql id="Example_Where_Clause"> <where> <foreach collection="oredCriteria" item="criteria" separator="or"> <if test="criteria.valid"> <trim prefix="(" prefixOverrides="and" suffix=")"> <foreach collection="criteria.criteria" item="criterion"> <choose> <when test="criterion.noValue"> and ${criterion.condition} </when> <when test="criterion.singleValue"> and ${criterion.condition} #{criterion.value} </when> <when test="criterion.betweenValue"> and ${criterion.condition} #{criterion.value} and #{criterion.secondValue} </when> <when test="criterion.listValue"> and ${criterion.condition} <foreach close=")" collection="criterion.value" item="listItem" open="(" separator=","> #{listItem} </foreach> </when> </choose> </foreach> </trim> </if> </foreach> </where> </sql> <sql id="Update_By_Example_Where_Clause"> <where> <foreach collection="example.oredCriteria" item="criteria" separator="or"> <if test="criteria.valid"> <trim prefix="(" prefixOverrides="and" suffix=")"> <foreach collection="criteria.criteria" item="criterion"> <choose> <when test="criterion.noValue"> and ${criterion.condition} </when> <when test="criterion.singleValue"> and ${criterion.condition} #{criterion.value} </when> <when test="criterion.betweenValue"> and ${criterion.condition} #{criterion.value} and #{criterion.secondValue} </when> <when test="criterion.listValue"> and ${criterion.condition} <foreach close=")" collection="criterion.value" item="listItem" open="(" separator=","> #{listItem} </foreach> </when> </choose> </foreach> </trim> </if> </foreach> </where> </sql> <sql id="Base_Column_List"> SYS_ID , OBJ_ID , OBJ_NAME , OBJ_DESCRIPTION , CREATOR , CREATE_TIME , UPDATE_OPERATOR , UPDATE_TIME , CLIENT_CHK_FLAG , CELL_PHONE , REG_EMAIL , GENDER , QQ_NO , WEB_URL </sql> <sql id="From_join"> from T_ACNT </sql> <select id="selectByExample" parameterType="com.test.entity.TAcntCriteria" resultMap="BaseResultMap"> select <if test="distinct"> distinct </if> <include refid="Base_Column_List" /> <include refid="From_join" /> <if test="_parameter != null"> <include refid="Example_Where_Clause" /> </if> <if test="orderByClause != null"> order by ${orderByClause} </if> </select> <select id="selectByPrimaryKey" parameterType="BigDecimal" resultMap="BaseResultMap"> select <include refid="Base_Column_List" /> <include refid="From_join" /> where SYS_ID = #{sysId,jdbcType=DECIMAL} </select> <delete id="deleteByExample" parameterType="com.test.entity.TAcntCriteria"> delete from T_ACNT <if test="_parameter != null"> <include refid="Example_Where_Clause" /> </if> </delete> <insert id="insert" parameterType="com.test.entity.TAcnt"> insert into T_ACNT ( OBJ_ID , OBJ_NAME , OBJ_DESCRIPTION , CREATOR , CREATE_TIME , UPDATE_OPERATOR , UPDATE_TIME , CLIENT_CHK_FLAG , CELL_PHONE , REG_EMAIL , GENDER , QQ_NO , WEB_URL ) values ( #{objId,jdbcType=VARCHAR} , #{objName,jdbcType=VARCHAR} , #{objDescription,jdbcType=VARCHAR} , #{creator,jdbcType=VARCHAR} , #{createTime,jdbcType=TIMESTAMP} , #{updateOperator,jdbcType=VARCHAR} , #{updateTime,jdbcType=TIMESTAMP} , #{clientChkFlag,jdbcType=DECIMAL} , #{cellPhone,jdbcType=VARCHAR} , #{regEmail,jdbcType=VARCHAR} , #{gender,jdbcType=DECIMAL} , #{qqNo,jdbcType=VARCHAR} , #{webUrl,jdbcType=VARCHAR} ) </insert> <select id="countByExample" parameterType="com.test.entity.TAcntCriteria" resultType="java.lang.Integer"> select count(*) <include refid="From_join" /> <if test="_parameter != null"> <include refid="Example_Where_Clause" /> </if> </select> <update id="updateByExample" parameterType="map"> update T_ACNT set OBJ_ID = #{record.objId,jdbcType=VARCHAR} , OBJ_NAME = #{record.objName,jdbcType=VARCHAR} , OBJ_DESCRIPTION = #{record.objDescription,jdbcType=VARCHAR} , CREATOR = #{record.creator,jdbcType=VARCHAR} , CREATE_TIME = #{record.createTime,jdbcType=TIMESTAMP} , UPDATE_OPERATOR = #{record.updateOperator,jdbcType=VARCHAR} , UPDATE_TIME = #{record.updateTime,jdbcType=TIMESTAMP} , CLIENT_CHK_FLAG = #{record.clientChkFlag,jdbcType=DECIMAL} , CELL_PHONE = #{record.cellPhone,jdbcType=VARCHAR} , REG_EMAIL = #{record.regEmail,jdbcType=VARCHAR} , GENDER = #{record.gender,jdbcType=DECIMAL} , QQ_NO = #{record.qqNo,jdbcType=VARCHAR} , WEB_URL = #{record.webUrl,jdbcType=VARCHAR} <if test="_parameter != null"> <include refid="Update_By_Example_Where_Clause" /> </if> </update> <update id="updateByPrimaryKeySelective" parameterType="com.test.entity.TAcnt"> update T_ACNT <set> <if test="objId != null"> OBJ_ID = #{objId,jdbcType=VARCHAR}, </if> <if test="objName != null"> OBJ_NAME = #{objName,jdbcType=VARCHAR}, </if> <if test="objDescription != null"> OBJ_DESCRIPTION = #{objDescription,jdbcType=VARCHAR}, </if> <if test="creator != null"> CREATOR = #{creator,jdbcType=VARCHAR}, </if> <if test="createTime != null"> CREATE_TIME = #{createTime,jdbcType=TIMESTAMP}, </if> <if test="updateOperator != null"> UPDATE_OPERATOR = #{updateOperator,jdbcType=VARCHAR}, </if> <if test="updateTime != null"> UPDATE_TIME = #{updateTime,jdbcType=TIMESTAMP}, </if> <if test="clientChkFlag != null"> CLIENT_CHK_FLAG = #{clientChkFlag,jdbcType=DECIMAL}, </if> <if test="cellPhone != null"> CELL_PHONE = #{cellPhone,jdbcType=VARCHAR}, </if> <if test="regEmail != null"> REG_EMAIL = #{regEmail,jdbcType=VARCHAR}, </if> <if test="gender != null"> GENDER = #{gender,jdbcType=DECIMAL}, </if> <if test="qqNo != null"> QQ_NO = #{qqNo,jdbcType=VARCHAR}, </if> <if test="webUrl != null"> WEB_URL = #{webUrl,jdbcType=VARCHAR}, </if> </set> where SYS_ID = #{sysId,jdbcType=DECIMAL} </update> </mapper></span>
当然，这仅仅是第一步，如果你想写出一个彻底防止SQL盲注的系统。那么还是需要对用户发出的请求进行过滤，而且还要包括请求中的参数值，很有可能包括一些危险字符，这些危险字符就是我们需要过滤并处理的问题所在。关于解决危险字符这一块，我留到后面细说，因为这涉及到很多个漏洞，包括：XSS，CSRF等等。

结束语