我有一个变量,即表名,我想使用休眠将其传递给查询并用两个单引号引起来。
我不想使用+对其进行修饰,因为Hello SQL Injection
public List <Long> getAllTableColumns(String tableName) {
String request = "SELECT column_name FROM information_schema.columns " +
"WHERE table_schema = 'test' AND table_name = :tableName " ;
Query query = entityManager.createNativeQuery(request).setParameter("tableName", tableName);
List<BigDecimal> resultList = query.getResultList() ;
return resultList.stream().map(BigDecimal::longValue).collect(Collectors.toList());
}
此请求的结果是
SELECT column_name FROM information_schema.columns WHERE table_schema = 'test' AND table_name = user
,预期结果是
SELECT column_name FROM information_schema.columns WHERE table_schema = 'test' AND table_name = 'user'