查詢中的字符串參數

Question

我是程序員學習者。

我想MySQL查詢從我的代碼

if(params.openCheckBox){ 
    query +=" (t.status IN ("+params.openCheckBox+", "+params.DeliveredCheckBox+")" 
    query +=")" 
} 

以下格式

select status from training where status in ("Open", "Delivered") 

但它給

select status from training where status in (Open, Delivered) 

這裏 「」（雙引號缺失）

Answer 1

越獄le引用\，MySQL接受雙引號來包裝字符串。

query +=" (t.status IN (\""+params.openCheckBox+"\", \""+params.DeliveredCheckBox+"\")" 
query +=")" 

或 只使用單引號

query +=" (t.status IN ('"+params.openCheckBox+"', '"+params.DeliveredCheckBox+"')" 
query +=")" 

上面的查詢與sql injection脆弱。利用PreparedStatement像下面

代碼段的一個：

dbConnection = getDBConnection(); 
String query = "SELECT .... FROM .... WHERE t.status IN (?, ?)"; 
PreparedStatement preparedStatement = dbConnection.prepareStatement(query); 
preparedStatement.setString(1, params.openCheckBox); 
preparedStatement.setString(2, params.DeliveredCheckBox); 
ResultSet rs = preparedStatement.executeQuery(); 

來源

• PreparedStatement
• JDBC PreparedStatement Example

Answer 2

您可以使用單引號代替。

query +=" (t.status IN ('"+params.openCheckBox+"', '"+params.DeliveredCheckBox+"')"