我有一个字符串SELECT *FROM USERS WHERE ID = '@userid@' AND ROLE = '@role@'
现在我已经用@实际值替换@ ... @之间的任何字符串。
预期产量SELECT *FROM USERS WHERE ID = '4' AND ROLE = 'Admin'
这个替换将从一个方法发生,我写了这个逻辑
public String replaceQueryKeyWithValueFromKeyValues(String query, int reportId) {
try {
REPMReportDao repmReportDao = new REPMReportDao();
int Start = 0;
int end;
if (query.contains("@")) {
boolean specialSymbolFound = false;
for (int i = 0; i < query.length(); i++) {
if (query.charAt(i) == '@') {
if (!specialSymbolFound) {
Start = i + 1;
specialSymbolFound = true;
} else {
specialSymbolFound = false;
end = i;
query = query.replace(query.substring(Start - 1, end + 1), repmReportDao.getReportManagerKeyValue(query.substring(Start - 1, end + 1).replaceAll("@", ""), reportId));
}
}
}
return query;
} else {
return query;
}
} catch (Exception e) {
logger.log(Priority.ERROR, e.getMessage());
return e.getMessage();
}
}
它工作正常,但如果存在单个'@'符号而不是开始和结束,它将失败。喜欢 :
SELECT *FROM USERS WHERE emailid = '[email protected]' AND ROLE = '@role@'
在这里,它应该替换唯一的角色'@ role @',并且应该保留电子邮件原样。
预期产出=> SELECT *FROM USERS WHERE emailid = '[email protected]' AND ROLE = 'Admin'
getReportManagerKeyValue
返回的模拟数据的完整示例:
import java.util.HashMap;
import java.util.Map;
import java.util.regex.Matcher;
import java.util.regex.Pattern;
public class StackOverflow54842971 {
private static Map<String, String> map;
public static void main(String[] args) {
// preparing test data
map = new HashMap<>();
map.put("role", "Admin");
map.put("userid", "666");
// original query string
String query = "SELECT * FROM USERS WHERE ID = '@userid@' AND emailid = '[email protected]' AND ROLE = '@role@' ";
// regular expression to match everything between '@ and @' with capture group
// omitting single quotes
Pattern p = Pattern.compile("'(@[^@]*@)'");
Matcher m = p.matcher(query);
while (m.find()) {
// every match will be replaced with value from getReportManagerKeyValue
query = query.replace(m.group(1), getReportManagerKeyValue(m.group(1).replaceAll("@", "")));
}
System.out.println(query);
}
// you won't need this function
private static String getReportManagerKeyValue(String key) {
System.out.println("getting key " + key);
if (!map.containsKey(key)) {
return "'null'";
}
return map.get(key);
}
}
使用字符串替换生成数据库查询被认为是非常糟糕的做法,因为您将代码保持为SQL注入攻击。我无法从您提供的小代码示例中看出,但绝大多数大型Java项目都使用Spring Framework,它允许您使用JdbcTemplate或(我的偏好)NamedParameterJdbcTemplate。两者都允许您以安全的方式替换变量。