技術標籤：資料庫

好長時間不寫,連文章入口在哪都不知道!!!!

解決sql注入問題,測試in語法的時候,怎麼都查不到資料.後來發現我應該用

setParameterList(),而不是setParameter().

String a = "140421197501105174,140421197501105174";
List<Map<String, String>> returnList = new ArrayList<Map<String, String>>();
Query q = session.createSQLQuery("select  * from ** where userId in (:userId)");
List<String> s = Arrays.asList(a.split(","));
q.setParameter("userId",a.split(","));
String b = q.getQueryString();
List aa = q.list();