Google App Engine的JDO:逃脱报价
-
19-09-2019 - |
题
如何逃避JDO(Google App Engine)中查询的参数?
例如,如果变量名称可能包含不安全的字样('),我该如何使下一个摘要安全
PersistenceManager pm = ...;
String query = "select from Person where name='"+name+"'";
List<Shortened> shortened = (List<Shortened>) pm.newQuery(query).execute();
解决方案
相反,使用查询参数,比在查询本身中包含值要安全得多。这是GAE文档中的一个示例:
Query query = pm.newQuery("select from Employee " +
"where lastName == lastNameParam " +
"order by hireDate desc " +
"parameters String lastNameParam");
List<Employee> results = (List<Employee>) query.execute("Smith");
不隶属于 StackOverflow