<span style="font-family:Comic Sans MS;font-size:12px;"><?xml version="1.0" encoding="UTF⑻"?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis⑶-mapper.dtd">
<mapper namespace="com.test.dao.TAcntMapper">
<resultMap id="BaseResultMap" type="com.test.entity.TAcnt">
<id column="SYS_ID" jdbcType="DECIMAL" property="sysId" />
<result column="OBJ_ID" jdbcType="VARCHAR" property="objId" />
<result column="OBJ_NAME" jdbcType="VARCHAR" property="objName" />
<result column="OBJ_DESCRIPTION" jdbcType="VARCHAR" property="objDescription" />
<result column="CREATOR" jdbcType="VARCHAR" property="creator" />
<result column="CREATE_TIME" jdbcType="TIMESTAMP" property="createTime" />
<result column="UPDATE_OPERATOR" jdbcType="VARCHAR" property="updateOperator" />
<result column="UPDATE_TIME" jdbcType="TIMESTAMP" property="updateTime" />
<result column="CLIENT_CHK_FLAG" jdbcType="DECIMAL" property="clientChkFlag" />
<result column="CELL_PHONE" jdbcType="VARCHAR" property="cellPhone" />
<result column="REG_EMAIL" jdbcType="VARCHAR" property="regEmail" />
<result column="GENDER" jdbcType="DECIMAL" property="gender" />
<result column="QQ_NO" jdbcType="VARCHAR" property="qqNo" />
<result column="WEB_URL" jdbcType="VARCHAR" property="webUrl" />
</resultMap>
<sql id="Example_Where_Clause">
<where>
<foreach collection="oredCriteria" item="criteria" separator="or">
<if test="criteria.valid">
<trim prefix="(" prefixOverrides="and" suffix=")">
<foreach collection="criteria.criteria" item="criterion">
<choose>
<when test="criterion.noValue">
and ${criterion.condition}
</when>
<when test="criterion.singleValue">
and ${criterion.condition} #{criterion.value}
</when>
<when test="criterion.betweenValue">
and ${criterion.condition} #{criterion.value} and #{criterion.secondValue}
</when>
<when test="criterion.listValue">
and ${criterion.condition}
<foreach close=")" collection="criterion.value" item="listItem" open="(" separator=",">
#{listItem}
</foreach>
</when>
</choose>
</foreach>
</trim>
</if>
</foreach>
</where>
</sql>
<sql id="Update_By_Example_Where_Clause">
<where>
<foreach collection="example.oredCriteria" item="criteria" separator="or">
<if test="criteria.valid">
<trim prefix="(" prefixOverrides="and" suffix=")">
<foreach collection="criteria.criteria" item="criterion">
<choose>
<when test="criterion.noValue">
and ${criterion.condition}
</when>
<when test="criterion.singleValue">
and ${criterion.condition} #{criterion.value}
</when>
<when test="criterion.betweenValue">
and ${criterion.condition} #{criterion.value} and #{criterion.secondValue}
</when>
<when test="criterion.listValue">
and ${criterion.condition}
<foreach close=")" collection="criterion.value" item="listItem" open="(" separator=",">
#{listItem}
</foreach>
</when>
</choose>
</foreach>
</trim>
</if>
</foreach>
</where>
</sql>
<sql id="Base_Column_List">
SYS_ID , OBJ_ID , OBJ_NAME , OBJ_DESCRIPTION , CREATOR , CREATE_TIME , UPDATE_OPERATOR , UPDATE_TIME , CLIENT_CHK_FLAG , CELL_PHONE , REG_EMAIL , GENDER , QQ_NO , WEB_URL </sql>
<sql id="From_join">
from T_ACNT
</sql>
<select id="selectByExample" parameterType="com.test.entity.TAcntCriteria" resultMap="BaseResultMap">
select
<if test="distinct">
distinct
</if>
<include refid="Base_Column_List" />
<include refid="From_join" />
<if test="_parameter != null">
<include refid="Example_Where_Clause" />
</if>
<if test="orderByClause != null">
order by ${orderByClause}
</if>
</select>
<select id="selectByPrimaryKey" parameterType="BigDecimal" resultMap="BaseResultMap">
select
<include refid="Base_Column_List" />
<include refid="From_join" />
where SYS_ID = #{sysId,jdbcType=DECIMAL}
</select>
<delete id="deleteByExample" parameterType="com.test.entity.TAcntCriteria">
delete from T_ACNT
<if test="_parameter != null">
<include refid="Example_Where_Clause" />
</if>
</delete>
<insert id="insert" parameterType="com.test.entity.TAcnt">
insert into T_ACNT ( OBJ_ID , OBJ_NAME , OBJ_DESCRIPTION , CREATOR , CREATE_TIME , UPDATE_OPERATOR , UPDATE_TIME , CLIENT_CHK_FLAG , CELL_PHONE , REG_EMAIL , GENDER , QQ_NO , WEB_URL )
values ( #{objId,jdbcType=VARCHAR} , #{objName,jdbcType=VARCHAR} , #{objDescription,jdbcType=VARCHAR} , #{creator,jdbcType=VARCHAR} , #{createTime,jdbcType=TIMESTAMP} , #{updateOperator,jdbcType=VARCHAR} , #{updateTime,jdbcType=TIMESTAMP} , #{clientChkFlag,jdbcType=DECIMAL} , #{cellPhone,jdbcType=VARCHAR} , #{regEmail,jdbcType=VARCHAR} , #{gender,jdbcType=DECIMAL} , #{qqNo,jdbcType=VARCHAR} , #{webUrl,jdbcType=VARCHAR} )
</insert>
<select id="countByExample" parameterType="com.test.entity.TAcntCriteria" resultType="java.lang.Integer">
select count(*)
<include refid="From_join" />
<if test="_parameter != null">
<include refid="Example_Where_Clause" />
</if>
</select>
<update id="updateByExample" parameterType="map">
update T_ACNT
set OBJ_ID = #{record.objId,jdbcType=VARCHAR}
, OBJ_NAME = #{record.objName,jdbcType=VARCHAR}
, OBJ_DESCRIPTION = #{record.objDescription,jdbcType=VARCHAR}
, CREATOR = #{record.creator,jdbcType=VARCHAR}
, CREATE_TIME = #{record.createTime,jdbcType=TIMESTAMP}
, UPDATE_OPERATOR = #{record.updateOperator,jdbcType=VARCHAR}
, UPDATE_TIME = #{record.updateTime,jdbcType=TIMESTAMP}
, CLIENT_CHK_FLAG = #{record.clientChkFlag,jdbcType=DECIMAL}
, CELL_PHONE = #{record.cellPhone,jdbcType=VARCHAR}
, REG_EMAIL = #{record.regEmail,jdbcType=VARCHAR}
, GENDER = #{record.gender,jdbcType=DECIMAL}
, QQ_NO = #{record.qqNo,jdbcType=VARCHAR}
, WEB_URL = #{record.webUrl,jdbcType=VARCHAR}
<if test="_parameter != null">
<include refid="Update_By_Example_Where_Clause" />
</if>
</update>
<update id="updateByPrimaryKeySelective" parameterType="com.test.entity.TAcnt">
update T_ACNT
<set>
<if test="objId != null">
OBJ_ID = #{objId,jdbcType=VARCHAR},
</if>
<if test="objName != null">
OBJ_NAME = #{objName,jdbcType=VARCHAR},
</if>
<if test="objDescription != null">
OBJ_DESCRIPTION = #{objDescription,jdbcType=VARCHAR},
</if>
<if test="creator != null">
CREATOR = #{creator,jdbcType=VARCHAR},
</if>
<if test="createTime != null">
CREATE_TIME = #{createTime,jdbcType=TIMESTAMP},
</if>
<if test="updateOperator != null">
UPDATE_OPERATOR = #{updateOperator,jdbcType=VARCHAR},
</if>
<if test="updateTime != null">
UPDATE_TIME = #{updateTime,jdbcType=TIMESTAMP},
</if>
<if test="clientChkFlag != null">
CLIENT_CHK_FLAG = #{clientChkFlag,jdbcType=DECIMAL},
</if>
<if test="cellPhone != null">
CELL_PHONE = #{cellPhone,jdbcType=VARCHAR},
</if>
<if test="regEmail != null">
REG_EMAIL = #{regEmail,jdbcType=VARCHAR},
</if>
<if test="gender != null">
GENDER = #{gender,jdbcType=DECIMAL},
</if>
<if test="qqNo != null">
QQ_NO = #{qqNo,jdbcType=VARCHAR},
</if>
<if test="webUrl != null">
WEB_URL = #{webUrl,jdbcType=VARCHAR},
</if>
</set>
where SYS_ID = #{sysId,jdbcType=DECIMAL}
</update>
</mapper></span>
固然，這僅僅是第1步，如果你想寫(xiě)出1個(gè)完全避免SQL盲注的系統(tǒng)。那末還是需要對(duì)用戶(hù)發(fā)出的要求進(jìn)行過(guò)濾，而且還要包括要求中的參數(shù)值，很有可能包括1些危險(xiǎn)字符，這些危險(xiǎn)字符就是我們需要過(guò)濾并處理的問(wèn)題所在。關(guān)于解決危險(xiǎn)字符這1塊，我留到后面細(xì)說(shuō)，由于這觸及到很多個(gè)漏洞，包括：XSS，CSRF等等。
俗語(yǔ)說(shuō)，安全猛于虎！安全無(wú)小事！在http://www.vxbq.cn/Internet/上，這些也是1樣的。剛開(kāi)始接觸安全的我，也許說(shuō)是，剛開(kāi)始深入研究安全的我，正在汲取這方面的營(yíng)養(yǎng)，通過(guò)測(cè)試出來(lái)的安全漏洞，1點(diǎn)1點(diǎn)的解決潛伏的危機(jī)。這還僅僅是個(gè)開(kāi)始，后續(xù)的日子里還有很長(zhǎng)的路要走，大家1起加油吧。固然，如果有甚么新的感受，我也會(huì)寫(xiě)出來(lái)跟大家1起分享，1起進(jìn)步。
