查询中的字符串参数

Question

我是程序员学习者。

我想MySQL查询从我的代码

if(params.openCheckBox){ 
    query +=" (t.status IN ("+params.openCheckBox+", "+params.DeliveredCheckBox+")" 
    query +=")" 
} 

以下格式

select status from training where status in ("Open", "Delivered") 

但它给

select status from training where status in (Open, Delivered) 

这里 “”（双引号缺失）

Answer 1

越狱le引用\，MySQL接受双引号来包装字符串。

query +=" (t.status IN (\""+params.openCheckBox+"\", \""+params.DeliveredCheckBox+"\")" 
query +=")" 

或 只使用单引号

query +=" (t.status IN ('"+params.openCheckBox+"', '"+params.DeliveredCheckBox+"')" 
query +=")" 

上面的查询与sql injection脆弱。利用PreparedStatement像下面

代码段的一个：

dbConnection = getDBConnection(); 
String query = "SELECT .... FROM .... WHERE t.status IN (?, ?)"; 
PreparedStatement preparedStatement = dbConnection.prepareStatement(query); 
preparedStatement.setString(1, params.openCheckBox); 
preparedStatement.setString(2, params.DeliveredCheckBox); 
ResultSet rs = preparedStatement.executeQuery(); 

来源

• PreparedStatement
• JDBC PreparedStatement Example

Answer 2

您可以使用单引号代替。

query +=" (t.status IN ('"+params.openCheckBox+"', '"+params.DeliveredCheckBox+"')"