SQL注入休眠

Question

我正在使用hibernate，我需要替換此查詢以刪除SQL注入。

strQry = "FROM xxxx bob WHERE bob.brkxxxId ='" + brkxxxId + "' AND bob.xxxUser ='" + loginUserxxxId + "'"; 
i = session.delete(strQry); 

我改寫了這個查詢是這樣的：

session = getSession(); 
    strQry = "FROM xxxxbob bob WHERE bob.brkxxxId = :param1 AND bob.xxxUser = :param2"; 


     Query bobQuery = session.createQuery(strQry); 
     bobQuery.setParameter("param1", brkxxxId); 
     bobQuery.setParameter("param2", xxxUserTaxId); 

     java.util.List bobList = bobQuery.list(); 
     java.util.Iterator bobI1 = bobList.listIterator(); 
    while (bobI1.hasNext()){ 
       mapCache = (BOBMapCache) bobI1.next(); 
       session.delete(mapCache); 
      } 

其選擇列表時，即使該數據庫包含的值返回null。我不知道什麼是錯的。照看

Answer 1

嗨的代碼，我發現當你重寫了你的HQL，你忘了爲實體

session = getSession(); 
strQry = "FROM xxxxbob WHERE bob.brkxxxId = :param1 AND bob.xxxUser = :param2"; 

請更正創建aliase的HQL到

session = getSession(); 
strQry = "FROM xxxxbob bob WHERE bob.brkxxxId = :param1 AND bob.xxxUser = :param2"; 

我檢查一遍

 Query bobQuery = session.createQuery(strQry); 
     bobQuery.setParameter("param1", brkxxxId); 
     bobQuery.setParameter("param2", xxxUserTaxId); 

您缺少以下代碼段，請修改該代碼

entityManager.createQuery(bobQuery).getResultList(); 

初始化實體管理器

Session session = HibernateUtil.getSessionFactory().getCurrentSession(); 
    session.beginTransaction(); //Transaction began 
    try { 
    List list=session.createQuery(bobQuery).list(); 
    session.getTransaction().commit(); //Transaction committed 
    Iterator iterator= list.iterator(); 
    } catch (HibernateException e) { 
     e.printStackTrace(); 
    }