使用Mybatis时由于粗心遇到Cause: java.sql.SQLException: sql injection violation异常

使用Mybatis插入数据时，由于粗心书写错误导致出现Cause: java.sql.SQLException: sql injection violation异常，SQL语句如下：

<insert id="insertProduct"parameterType="com.isoftstone.product.entity.ProductBean">insert into mmall_product(<include refid="baseInsertSql"/>)values (#{productId}, #{categoryId}, #{productName}, ${subtitle},#{mainImage}, #{subImages}, #{detail}, #{productPrice},#{stock}, #{status},<choose><when test="createTime != null">#{createTime},</when><otherwise>now(),</otherwise></choose><choose><when test="updateTime != null">#{updateTime}</when><otherwise>now()</otherwise></choose>)</insert>

异常详细堆栈信息如下：

org.springframework.jdbc.UncategorizedSQLException:
### Error updating database.  Cause: java.sql.SQLException: sql injection violation, syntax error: syntax error. pos 237, line 9, column 26, token IDENTIFIER phone : insert into mmall_product(id, category_id, name, subtitle, main_image, sub_images,detail, price, stock, status, create_time, update_time)values (?, ?, ?, hello phone,?, ?, ?, ?,?, ?,now(),now())
### SQL: insert into mmall_product         (                   id, category_id, name, subtitle, main_image, sub_images,         detail, price, stock, status, create_time, update_time               )         values (           ?, ?, ?, hello phone,           ?, ?, ?, ?,           ?, ?,                               now(),                                               now()                         )
### Cause: java.sql.SQLException: sql injection violation, syntax error: syntax error. pos 237, line 9, column 26, token IDENTIFIER phone : insert into mmall_product(id, category_id, name, subtitle, main_image, sub_images,detail, price, stock, status, create_time, update_time)values (?, ?, ?, hello phone,?, ?, ?, ?,?, ?,now(),now())
; uncategorized SQLException; SQL state [null]; error code [0]; sql injection violation, syntax error: syntax error. pos 237, line 9, column 26, token IDENTIFIER phone : insert into mmall_product(id, category_id, name, subtitle, main_image, sub_images,detail, price, stock, status, create_time, update_time)values (?, ?, ?, hello phone,?, ?, ?, ?,?, ?,now(),now()); nested exception is java.sql.SQLException: sql injection violation, syntax error: syntax error. pos 237, line 9, column 26, token IDENTIFIER phone : insert into mmall_product(id, category_id, name, subtitle, main_image, sub_images,detail, price, stock, status, create_time, update_time)values (?, ?, ?, hello phone,?, ?, ?, ?,?, ?,now(),now())at org.springframework.jdbc.support.AbstractFallbackSQLExceptionTranslator.translate(AbstractFallbackSQLExceptionTranslator.java:89)at org.springframework.jdbc.support.AbstractFallbackSQLExceptionTranslator.translate(AbstractFallbackSQLExceptionTranslator.java:81)at org.springframework.jdbc.support.AbstractFallbackSQLExceptionTranslator.translate(AbstractFallbackSQLExceptionTranslator.java:81)at org.mybatis.spring.MyBatisExceptionTranslator.translateExceptionIfPossible(MyBatisExceptionTranslator.java:73)at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:446)at com.sun.proxy.$Proxy87.insert(Unknown Source)at org.mybatis.spring.SqlSessionTemplate.insert(SqlSessionTemplate.java:278)at org.apache.ibatis.binding.MapperMethod.execute(MapperMethod.java:58)at org.apache.ibatis.binding.MapperProxy.invoke(MapperProxy.java:59)at com.sun.proxy.$Proxy97.insertProduct(Unknown Source)at com.isoftstone.product.mapper.ProductMapperTest.insertProduct(ProductMapperTest.java:26)at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)at java.lang.reflect.Method.invoke(Method.java:498)at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50)at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12)at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47)at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17)at org.springframework.test.context.junit4.statements.RunBeforeTestExecutionCallbacks.evaluate(RunBeforeTestExecutionCallbacks.java:74)at org.springframework.test.context.junit4.statements.RunAfterTestExecutionCallbacks.evaluate(RunAfterTestExecutionCallbacks.java:84)at org.springframework.test.context.junit4.statements.RunBeforeTestMethodCallbacks.evaluate(RunBeforeTestMethodCallbacks.java:75)at org.springframework.test.context.junit4.statements.RunAfterTestMethodCallbacks.evaluate(RunAfterTestMethodCallbacks.java:86)at org.springframework.test.context.junit4.statements.SpringRepeat.evaluate(SpringRepeat.java:84)at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325)at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.runChild(SpringJUnit4ClassRunner.java:251)at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.runChild(SpringJUnit4ClassRunner.java:97)at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290)at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71)at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288)at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58)at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268)at org.springframework.test.context.junit4.statements.RunBeforeTestClassCallbacks.evaluate(RunBeforeTestClassCallbacks.java:61)at org.springframework.test.context.junit4.statements.RunAfterTestClassCallbacks.evaluate(RunAfterTestClassCallbacks.java:70)at org.junit.runners.ParentRunner.run(ParentRunner.java:363)at org.springframework.test.context.junit4.SpringJUnit4ClassRunner.run(SpringJUnit4ClassRunner.java:190)at org.junit.runner.JUnitCore.run(JUnitCore.java:137)at com.intellij.junit4.JUnit4IdeaTestRunner.startRunnerWithArgs(JUnit4IdeaTestRunner.java:68)at com.intellij.rt.execution.junit.IdeaTestRunner$Repeater.startRunnerWithArgs(IdeaTestRunner.java:47)at com.intellij.rt.execution.junit.JUnitStarter.prepareStreamsAndStart(JUnitStarter.java:242)at com.intellij.rt.execution.junit.JUnitStarter.main(JUnitStarter.java:70)
Caused by: java.sql.SQLException: sql injection violation, syntax error: syntax error. pos 237, line 9, column 26, token IDENTIFIER phone : insert into mmall_product(id, category_id, name, subtitle, main_image, sub_images,detail, price, stock, status, create_time, update_time)values (?, ?, ?, hello phone,?, ?, ?, ?,?, ?,now(),now())at com.alibaba.druid.wall.WallFilter.checkInternal(WallFilter.java:798)at com.alibaba.druid.wall.WallFilter.connection_prepareStatement(WallFilter.java:251)at com.alibaba.druid.filter.FilterChainImpl.connection_prepareStatement(FilterChainImpl.java:568)at com.alibaba.druid.filter.FilterAdapter.connection_prepareStatement(FilterAdapter.java:929)at com.alibaba.druid.filter.FilterEventAdapter.connection_prepareStatement(FilterEventAdapter.java:122)at com.alibaba.druid.filter.FilterChainImpl.connection_prepareStatement(FilterChainImpl.java:568)at com.alibaba.druid.proxy.jdbc.ConnectionProxyImpl.prepareStatement(ConnectionProxyImpl.java:342)at com.alibaba.druid.pool.DruidPooledConnection.prepareStatement(DruidPooledConnection.java:349)at org.apache.ibatis.executor.statement.PreparedStatementHandler.instantiateStatement(PreparedStatementHandler.java:87)at org.apache.ibatis.executor.statement.BaseStatementHandler.prepare(BaseStatementHandler.java:88)at org.apache.ibatis.executor.statement.RoutingStatementHandler.prepare(RoutingStatementHandler.java:59)at org.apache.ibatis.executor.SimpleExecutor.prepareStatement(SimpleExecutor.java:85)at org.apache.ibatis.executor.SimpleExecutor.doUpdate(SimpleExecutor.java:49)at org.apache.ibatis.executor.BaseExecutor.update(BaseExecutor.java:117)at org.apache.ibatis.executor.CachingExecutor.update(CachingExecutor.java:76)at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)at java.lang.reflect.Method.invoke(Method.java:498)at org.apache.ibatis.plugin.Plugin.invoke(Plugin.java:63)at com.sun.proxy.$Proxy100.update(Unknown Source)at org.apache.ibatis.session.defaults.DefaultSqlSession.update(DefaultSqlSession.java:198)at org.apache.ibatis.session.defaults.DefaultSqlSession.insert(DefaultSqlSession.java:185)at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:62)at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)at java.lang.reflect.Method.invoke(Method.java:498)at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:433)... 36 more
Caused by: com.alibaba.druid.sql.parser.ParserException: syntax error. pos 237, line 9, column 26, token IDENTIFIER phoneat com.alibaba.druid.sql.parser.SQLStatementParser.parseValueClause(SQLStatementParser.java:3323)at com.alibaba.druid.sql.dialect.mysql.parser.MySqlStatementParser.parseInsert(MySqlStatementParser.java:2553)at com.alibaba.druid.sql.dialect.mysql.parser.MySqlStatementParser.parseInsert(MySqlStatementParser.java:47)at com.alibaba.druid.sql.parser.SQLStatementParser.parseStatementList(SQLStatementParser.java:167)at com.alibaba.druid.sql.parser.SQLStatementParser.parseStatementList(SQLStatementParser.java:83)at com.alibaba.druid.wall.WallProvider.checkInternal(WallProvider.java:624)at com.alibaba.druid.wall.WallProvider.check(WallProvider.java:578)at com.alibaba.druid.wall.WallFilter.checkInternal(WallFilter.java:785)... 63 more

分析：从错误信息来看是由于SQL语句有注入问题导致SQL解析失败。而导致该问题的罪魁祸首是使用了#{}和${}进行混合取值，通常情况下都是建议使用#{}进行取值，而不推荐使用${}进行取值，${}符号取值容易导致SQL注入，而在我的SQL语句中会发现我不小心将一个属性的取值使用了${}而导致SQL解析错误。

解决方案：将语句中的${}改为#{}。最终的SQL语句：

 <insert id="insertProduct"parameterType="com.isoftstone.product.entity.ProductBean">insert into mmall_product(<include refid="baseInsertSql"/>)values (#{productId}, #{categoryId}, #{productName}, #{subtitle},#{mainImage}, #{subImages}, #{detail}, #{productPrice},#{stock}, #{status},<choose><when test="createTime != null">#{createTime},</when><otherwise>now(),</otherwise></choose><choose><when test="updateTime != null">#{updateTime}</when><otherwise>now()</otherwise></choose>)</insert>

使用Mybatis时由于粗心遇到Cause: java.sql.SQLException: sql injection violation异常相关推荐

mybatis项目报java.sql.SQLException: Numeric Overflow的异常
转载自:http://www.easytd.com/yichangjijin/d_1411081846.html 项目报java.sql.SQLException: Numeric Overflow的 ...
Oracle Caused by: java.sql.SQLException: sql injection violation, syntax error: syntax error, expect
参考:https://blog.csdn.net/qq_36326332/article/details/102938147 https://blog.csdn.net/fly_captain/art ...
Cause: java.sql.SQLException: SQL String cannot be empty 解决方案
异常信息: Cause: java.sql.SQLException: SQL String cannot be empty 产生原因: 在批量进行SQL更新(或插入)时,有的时候会报错,有的时候不会 ...
解决 Error querying database. Cause: java.sql.SQLException: sql injection violation....
解决 Error querying database. Cause: java.sql.SQLException: sql injection violation- 最近在开发的时候老板的需求就是将模 ...
java todo error_java.sql.SQLException: sql injection violation, syntax error: TODO UNIQUE unique
@wenshao 你好,想跟你请教个问题: 我是在用activiti工作流的时候初始化生成流程表产生了下面的问题工作流引擎代码: ProcessEngineConfiguration confi ...
java.sql.SQLException: sql injection violation, part alway true condition not allow
这是我在思考调试sql注入出现的小bug 打印出来的SQL语句放在数据库执行 select id,name,age,phone from yu_student where phone = '123' ...
MySql java.sql.SQLException: sql injection violation, part alway false condition not allow异常简单处理方式
在sql语法正常下进行拼接sql语句时出现类似"1=1"等代码前面出现 and 或 or 时会被认为是sql注入解决方案一. 使用表名点字段名 members.name 二. ...
java.sql.SQLException: sql injection violation, multi-statement not allow
sql涉及到批量操作,开发环境正常执行,测试环境报错 sql injection violation, multi-statement not allow : update eqc_area_cust ...
java.sql.SQLException: sql injection violation, part alway false condition not allow
错误截图: 百度解释是防止sql注入,百度有的说是去掉druid里面filters里面的wall可以解决问题.但本人觉得这个方案有点难以接受.经测试发现如下原因会触发该bug: 截图sql: 在我的代 ...

使用Mybatis时由于粗心遇到Cause: java.sql.SQLException: sql injection violation异常

使用Mybatis时由于粗心遇到Cause: java.sql.SQLException: sql injection violation异常相关推荐

最新文章

热门文章