Question

我正在尝试使用简单的更新查询使用查询结果更新表。

这是查询。

def restore(def id, def contentId) {
        String hql = ""
        def q = revisionService.getRevisionById(id)
        hql = """UPDATE Content
                    SET
                     parentId = ${q.parent_id}
                    ,user_id = ${q.user_id}
                    ,inheritFromParent = ${q.inherit_from_parent}
                    ,forceSSL = ${q.forcessl}
                    ,title = ${q.title}
                    ,fileName = ${q.file_name}
                    ,fileNamePath = ${q.file_name_path}
                    ,fileNameLookup = ${q.file_name_lookup}
                    ,body = ${q.body}
                    ,summary = ${q.summary}
                    ,template = ${q.template}
                    ,layout = ${q.layout}
                    ,contentType = ${q.content_type}
                    ,isNavItem = ${q.is_nav_item}
                    ,navDepth = ${q.nav_depth}
                    ,navOrder = ${q.nav_order}
                    ,metaTitle = ${q.meta_title}
                    ,metaKeywords = ${q.meta_keywords}
                    ,metaDescription = ${q.meta_description}
                    ,isActive = ${q.is_active}
                    ,col1 = ${q.col1}
                    ,col2 = ${q.col2}
                    ,col3 = ${q.col3}
                    ,col4 = ${q.col4}
                    ,col5 = ${q.col5}
                    ,col6 = ${q.col6}
                    ,col7 = ${q.col7}
                    ,col8 = ${q.col8}
                    ,col9 = ${q.col9}
                    WHERE id = ${contentId}"""
        try {
            Content.executeUpdate(hql)
        } catch(Exception e) {
            println e
        }
    }

当我执行此查询时获得异常，说明org.springframework.orm.hibernate4.HibernateQueryException：意外令牌：大约在第7行附近，第50列。

这是我终端的堆栈跟踪。

line 7:50: unexpected token: about
Message: unexpected token: about
    Line | Method
->>  353 | $tt__restore in org.regionscms.ContentService$$EOqIswWO
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - 
|     48 | restore      in org.regionscms.ContentController
|    198 | doFilter . . in grails.plugin.cache.web.filter.PageFragmentCachingFilter
|     63 | doFilter     in grails.plugin.cache.web.filter.AbstractFilter
|     53 | doFilter . . in grails.plugin.springsecurity.web.filter.GrailsAnonymousAuthenticationFilter
|     49 | doFilter     in grails.plugin.springsecurity.web.authentication.RequestHolderAuthenticationFilter
|     82 | doFilter . . in grails.plugin.springsecurity.web.authentication.logout.MutableLogoutFilter
|   1145 | runWorker    in java.util.concurrent.ThreadPoolExecutor
|    615 | run . . . .  in java.util.concurrent.ThreadPoolExecutor$Worker
^    745 | run          in java.lang.Thread
org.springframework.orm.hibernate4.HibernateQueryException: unexpected token: about near line 7, column 50 [UPDATE org.regionscms.Content
                    SET
                     parentId = 1
                    ,user_id = 1
                    ,inheritFromParent = true
                    ,forceSSL = false
                    ,title = about us
                    ,fileName = about-us
                    ,fileNamePath = home/about-us
                    ,fileNameLookup = 72635069142711694
                    ,body = tests
                    ,summary = tests
                    ,template = index.gsp
                    ,layout = Main
                    ,contentType = Page
                    ,isNavItem = true
                    ,navDepth = 1
                    ,navOrder = 2
                    ,metaTitle = null
                    ,metaKeywords = null
                    ,metaDescription = null
                    ,isActive = true
                    ,col1 = 1045719790170831251
                    ,col2 = 72635069142711694
                    ,col3 = 0
                    ,col4 = 0
                    ,col5 = 0
                    ,col6 = 0
                    ,col7 = 0
                    ,col8 = 0
                    ,col9 = 0
                    WHERE id = 2]; nested exception is org.hibernate.hql.internal.ast.QuerySyntaxException: unexpected token: about near line 7, column 50 [UPDATE org.regionscms.Content
                    SET
                     parentId = 1
                    ,user_id = 1
                    ,inheritFromParent = true
                    ,forceSSL = false
                    ,title = about us
                    ,fileName = about-us
                    ,fileNamePath = home/about-us
                    ,fileNameLookup = 72635069142711694
                    ,body = tests
                    ,summary = tests
                    ,template = index.gsp
                    ,layout = Main
                    ,contentType = Page
                    ,isNavItem = true
                    ,navDepth = 1
                    ,navOrder = 2
                    ,metaTitle = null
                    ,metaKeywords = null
                    ,metaDescription = null
                    ,isActive = true
                    ,col1 = 1045719790170831251
                    ,col2 = 72635069142711694
                    ,col3 = 0
                    ,col4 = 0
                    ,col5 = 0
                    ,col6 = 0
                    ,col7 = 0
                    ,col8 = 0
                    ,col9 = 0
                    WHERE id = 2]

Answer 1

请参阅executeUpdate手册，了解如何正确使用这样的param地图：

Content.executeUpdate("UPDATE Content c SET parentId = :parentId, ... WHERE id = :contentId",
                  [cotentId: contentId, parentId: q.parentId, ...])

像你这样的代码基本上是SQL注入之路。这里的问题是使用GString替换，导致SQL无效（它应该是'about us'而不是about us）

在groovy中使用更新查询时出现意外的令牌错误

1 个答案: