jdbcTemplate 동적 조회 및 sql 주입 방지

1283 단어 jdbc
jdbcTemplate.update(sql,array)사용 하기;
sql 주입 방지
public Object updateCarGroup(CarGroupInfo carGroupInfo) {

		try {
			List param = new ArrayList<>();
			String sql = "UPDATE car_group_manage  SET ";
			if (carGroupInfo.getBgroupId() != null && !carGroupInfo.getBgroupId().equals("")) {

				sql += "bgroup_id= ? ";
				param.add(carGroupInfo.getBgroupId());
			}
			if (carGroupInfo.getName() != null && !carGroupInfo.getName().equals("")) {
				sql += ",name= ? ";
				param.add(carGroupInfo.getName());
			}
			if (carGroupInfo.getWorkArea() != null) {
				sql += ",work_area= ? ";
				param.add(carGroupInfo.getWorkArea());
			}
			if (carGroupInfo.getOwnArea() != null && 0 != carGroupInfo.getOwnArea()) {
				sql += ",own_area= ? ";
				param.add(carGroupInfo.getOwnArea());
			}
			sql += ",update_time=now() where id=?";

			param.add(carGroupInfo.getId());
			Object[] array = param.toArray(new Object[param.size()]);
			jdbcTemplate.update(sql, array);
		} catch (Exception e) {
			return new RRException(RongRunErrorCodeEnum.SYSTEM_ERROR).getCodeMsg();
		}

		return new RRException(RongRunErrorCodeEnum.SUCCESS).getCodeMsg();
	}

좋은 웹페이지 즐겨찾기