SQL注入休眠

Question

我正在使用hibernate，我需要替换此查询以删除SQL注入。

strQry = "FROM xxxx bob WHERE bob.brkxxxId ='" + brkxxxId + "' AND bob.xxxUser ='" + loginUserxxxId + "'"; 
i = session.delete(strQry); 

我改写了这个查询是这样的：

session = getSession(); 
    strQry = "FROM xxxxbob bob WHERE bob.brkxxxId = :param1 AND bob.xxxUser = :param2"; 


     Query bobQuery = session.createQuery(strQry); 
     bobQuery.setParameter("param1", brkxxxId); 
     bobQuery.setParameter("param2", xxxUserTaxId); 

     java.util.List bobList = bobQuery.list(); 
     java.util.Iterator bobI1 = bobList.listIterator(); 
    while (bobI1.hasNext()){ 
       mapCache = (BOBMapCache) bobI1.next(); 
       session.delete(mapCache); 
      } 

其选择列表时，即使该数据库包含的值返回null。我不知道什么是错的。照看

Answer 1

嗨的代码，我发现当你重写了你的HQL，你忘了为实体

session = getSession(); 
strQry = "FROM xxxxbob WHERE bob.brkxxxId = :param1 AND bob.xxxUser = :param2"; 

请更正创建aliase的HQL到

session = getSession(); 
strQry = "FROM xxxxbob bob WHERE bob.brkxxxId = :param1 AND bob.xxxUser = :param2"; 

我检查一遍

 Query bobQuery = session.createQuery(strQry); 
     bobQuery.setParameter("param1", brkxxxId); 
     bobQuery.setParameter("param2", xxxUserTaxId); 

您缺少以下代码段，请修改该代码

entityManager.createQuery(bobQuery).getResultList(); 

初始化实体管理器

Session session = HibernateUtil.getSessionFactory().getCurrentSession(); 
    session.beginTransaction(); //Transaction began 
    try { 
    List list=session.createQuery(bobQuery).list(); 
    session.getTransaction().commit(); //Transaction committed 
    Iterator iterator= list.iterator(); 
    } catch (HibernateException e) { 
     e.printStackTrace(); 
    }