执行 public void update(DeptParam deptParam){}方法时报异常,修改失败

来源:7-4 新增部门、部门层级树、更新部门接口自测

Screenly

2018-09-08

老师您好!我在执行public void update(DeptParam deptParam){}//修改部门信息的方法时,控制台输出异常:

org.springframework.jdbc.UncategorizedSQLException: 
### Error querying database.  Cause: java.sql.SQLException: sql injection violation, syntax error: syntax error, error in :'
    WHEN level LIKE ? || '.%' -- l',expect WHEN, actual WHEN WHEN : SELECT
     
    id, name, parent_id, level, seq, remark, operator, operator_time, operator_ip
   
    FROM sys_dept
    WHEN level LIKE ? || '.%' -- level like '0.%'
### The error may exist in file [D:\Code\JAVA\imooc\permission\target\permission\WEB-INF\classes\mapper\SysDeptMapper.xml]
### The error may involve com.cxqy.dao.SysDeptMapper.getChildDeptListByLevel
### The error occurred while executing a query
### SQL: SELECT           id, name, parent_id, level, seq, remark, operator, operator_time, operator_ip         FROM sys_dept     WHEN level LIKE ? || '.%' -- level like '0.%'
### Cause: java.sql.SQLException: sql injection violation, syntax error: syntax error, error in :'
    WHEN level LIKE ? || '.%' -- l',expect WHEN, actual WHEN WHEN : SELECT
     
    id, name, parent_id, level, seq, remark, operator, operator_time, operator_ip
   
    FROM sys_dept
    WHEN level LIKE ? || '.%' -- level like '0.%'
; uncategorized SQLException for SQL []; SQL state [null]; error code [0]; sql injection violation, syntax error: syntax error, error in :'
    WHEN level LIKE ? || '.%' -- l',expect WHEN, actual WHEN WHEN : SELECT
     
    id, name, parent_id, level, seq, remark, operator, operator_time, operator_ip
   
    FROM sys_dept
    WHEN level LIKE ? || '.%' -- level like '0.%'; nested exception is java.sql.SQLException: sql injection violation, syntax error: syntax error, error in :'
    WHEN level LIKE ? || '.%' -- l',expect WHEN, actual WHEN WHEN : SELECT
     
    id, name, parent_id, level, seq, remark, operator, operator_time, operator_ip
   
    FROM sys_dept
    WHEN level LIKE ? || '.%' -- level like '0.%'
写回答

1回答

Jimin

2018-09-08

你好,这个代码看着有点问题,这里当时写的时候也稍微有点问题。不知道你是否获取了项目的最新代码,你可以对比看一下。
单独看你这个sql,至少where条件那里是有问题的,拼接出问题了,而且貌似缺少了分号。

0
1
Screenly
非常感谢!
2018-09-09
共1条回复

Java开发企业级权限管理系统

源于企业真实Java项目,涉及大量高级技巧,覆盖权限管理开发技术

2261 学习 · 1347 问题

查看课程