改掉sql拼接（sql注入漏洞）

娄高锋
1 parent da8632ab
Showing 1 changed file with 229 additions and 247 deletions
src/main/java/com/bsth/service/report/impl/ReportServiceImpl.java
@@ -398,19 +398,22 @@ public class ReportServiceImpl implements ReportService{
 		Map<String, Object> map=new HashMap<String,Object>();
 		// TODO Auto-generated method stub
+		List<String> objList = new ArrayList<String>();
+		objList.add(ttinfo);
+		
 		//查询配车
 		String sqlPc=" select count(*) from (select lp, count(*) from"
-				+ " bsth_c_s_ttinfo_detail where ttinfo ='"+ttinfo+"'"
+				+ " bsth_c_s_ttinfo_detail where ttinfo = ?"
 				+ " group by lp ) a";
 		//配车
-		int pcs=jdbcTemplate.queryForObject(sqlPc, Integer.class);
+		int pcs=jdbcTemplate.queryForObject(sqlPc, objList.toArray(), Integer.class);
 		String sqlPlan=" SELECT jhlc,bc_type,fcsj FROM bsth_c_s_ttinfo_detail "
-				+" where ttinfo ='"+ttinfo+"' ";
+				+" where ttinfo = ? ";
 		//查询班次
-		List<Map<String, Object>> listPlan= jdbcTemplate.query(sqlPlan,
+		List<Map<String, Object>> listPlan= jdbcTemplate.query(sqlPlan, objList.toArray(),
 				new RowMapper<Map<String, Object>>(){
 					@Override
 					public Map<String, Object>  mapRow(ResultSet rs, int rowNum) throws SQLException {
@@ -482,25 +485,33 @@ public class ReportServiceImpl implements ReportService{
 		String minfcsj="02:00";
         List<Line> lineList=lineRepository.findLineByCode(line);
         if(lineList.size()>0){
-        	String sql = "select count(*) from bsth_c_line_config where line = '"+lineList.get(0).getId()+"'";
-        	if(jdbcTemplate.queryForObject(sql, Integer.class) > 0){
+        	List<String> objList = new ArrayList<String>();
+    		objList.add(lineList.get(0).getId() + "");
+        	String sql = "select count(*) from bsth_c_line_config where line = ? ";
+        	if(jdbcTemplate.queryForObject(sql, objList.toArray(), Integer.class) > 0){
 		        String sqlMinYysj="select start_opt from bsth_c_line_config where "
 		         		+ " id = ("
-		         		+ "select max(id) from bsth_c_line_config where line ='"+lineList.get(0).getId() +"'"
+		         		+ "select max(id) from bsth_c_line_config where line = ? "
 		         		+ ")";
-		        minfcsj=jdbcTemplate.queryForObject(sqlMinYysj, String.class);
+		        minfcsj=jdbcTemplate.queryForObject(sqlMinYysj, objList.toArray(), String.class);
         	}
         }
 		String[] minSjs = minfcsj.split(":");
 		int minSj=Integer.parseInt(minSjs[0])*60+Integer.parseInt(minSjs[1]);
+		
+		List<String> objList = new ArrayList<String>();
+		objList.add(ttinfo);
+		objList.add(minfcsj);
+		objList.add(ttinfo);
+		objList.add(minfcsj);
 		//查询时间里程
 		String sqlPc=" (SELECT jhlc,fcsj,bc_type,bcsj,lp,2 as xh, ists FROM bsth_c_s_ttinfo_detail "
-				+ " where ttinfo ='"+ttinfo+"' and fcsj <='"+minfcsj+"' ) "
+				+ " where ttinfo = ? and fcsj <= ? ) "
 				+ " union "
 				+ " (SELECT jhlc,fcsj,bc_type,bcsj,lp,1 as xh, ists FROM bsth_c_s_ttinfo_detail "
-				+ " where ttinfo ='"+ttinfo+"' and fcsj > '"+minfcsj+"' ) order by lp,xh,fcsj";
+				+ " where ttinfo = ? and fcsj > ? ) order by lp,xh,fcsj";
 		Map<String, Object> map=new HashMap<String,Object>();
-		List<Map<String, Object>> list= jdbcTemplate.query(sqlPc,
+		List<Map<String, Object>> list= jdbcTemplate.query(sqlPc, objList.toArray(),
 				new RowMapper<Map<String, Object>>(){
 					@Override
 					public Map<String, Object>  mapRow(ResultSet rs, int rowNum) throws SQLException {
@@ -620,11 +631,13 @@ public class ReportServiceImpl implements ReportService{
 		List<Map<String, Object>> list=new ArrayList<Map<String,Object>>();
 		List<Map<String, Object>> list_s=new ArrayList<Map<String,Object>>();
+		List<String> objList = new ArrayList<String>();
+		objList.add(ttinfo);
 		String sqlCl="SELECT lp cl_zbh,qdz_name,bc_type,fcsj,bcsj FROM"
-				+ "  bsth_c_s_ttinfo_detail WHERE ttinfo = '"+ttinfo+"' "
+				+ "  bsth_c_s_ttinfo_detail WHERE ttinfo = ? "
 				+ " AND  (bc_type = 'normal' or bc_type='region') order by qdz_name";
-		List<Map<String, Object>> listj= jdbcTemplate.query(sqlCl,
+		List<Map<String, Object>> listj= jdbcTemplate.query(sqlCl, objList.toArray(),
 				new RowMapper<Map<String, Object>>(){
 					@Override
 					public Map<String, Object>  mapRow(ResultSet rs, int rowNum) throws SQLException {
@@ -638,10 +651,10 @@ public class ReportServiceImpl implements ReportService{
 					}
 				});
-		String sqlZd="select qdz_name,bc_type from bsth_c_s_ttinfo_detail WHERE ttinfo = '"+ttinfo+"' "
+		String sqlZd="select qdz_name,bc_type from bsth_c_s_ttinfo_detail WHERE ttinfo = ? "
 				+ " AND (bc_type = 'normal' or bc_type='region') group by qdz_name ,bc_type "
 				+ " order by qdz_name";
-		List<Map<String, Object>> lists= jdbcTemplate.query(sqlZd,
+		List<Map<String, Object>> lists= jdbcTemplate.query(sqlZd, objList.toArray(),
 				new RowMapper<Map<String, Object>>(){
 					@Override
 					public Map<String, Object>  mapRow(ResultSet rs, int rowNum) throws SQLException {
@@ -803,27 +816,34 @@ public class ReportServiceImpl implements ReportService{
 		String minfcsj="02:00";
         List<Line> lineList=lineRepository.findLineByCode(line);
         if(lineList.size()>0){
-        	String sql = "select count(*) from bsth_c_line_config where line = '"+lineList.get(0).getId()+"'";
-        	if(jdbcTemplate.queryForObject(sql, Integer.class) > 0){
+        	List<String> objList = new ArrayList<String>();
+    		objList.add(lineList.get(0).getId() + "");
+        	String sql = "select count(*) from bsth_c_line_config where line = ? ";
+        	if(jdbcTemplate.queryForObject(sql, objList.toArray(), Integer.class) > 0){
 		        String sqlMinYysj="select start_opt from bsth_c_line_config where "
 		         		+ " id = ("
-		         		+ "select max(id) from bsth_c_line_config where line ='"+lineList.get(0).getId() +"'"
+		         		+ "select max(id) from bsth_c_line_config where line = ?"
 		         		+ ")";
-		        minfcsj=jdbcTemplate.queryForObject(sqlMinYysj, String.class);
+		        minfcsj=jdbcTemplate.queryForObject(sqlMinYysj, objList.toArray(), String.class);
         	}
         }
+        List<String> objList = new ArrayList<String>();
+		objList.add(ttinfo);
+		objList.add(minfcsj);
+		objList.add(ttinfo);
+		objList.add(minfcsj);
 		//查询全程
 		String sqlqc="select t.* from ( "
 				+ " (SELECT bc_type, fcsj,qdz,2 as xh,xl_dir,qdz_name FROM bsth_c_s_ttinfo_detail "
-				+ " where ttinfo ='"+ttinfo+"' and (bc_type='normal' || bc_type='region') "
-				+ " and fcsj <='"+minfcsj+"') "
+				+ " where ttinfo = ? and (bc_type='normal' || bc_type='region') "
+				+ " and fcsj <= ?) "
 				+ " union "
 				+ " (SELECT bc_type, fcsj,qdz,1 as xh,xl_dir,qdz_name FROM bsth_c_s_ttinfo_detail "
-				+ " where ttinfo ='"+ttinfo+"' and (bc_type='normal' || bc_type='region') "
-				+ " and fcsj > '"+minfcsj+"') "
+				+ " where ttinfo = ? and (bc_type='normal' || bc_type='region') "
+				+ " and fcsj > ?) "
 				+ "order by  xl_dir,xh,fcsj ) t ";
-		List<Map<String, String>> qclist= jdbcTemplate.query(sqlqc,
+		List<Map<String, String>> qclist= jdbcTemplate.query(sqlqc, objList.toArray(),
 				new RowMapper<Map<String, String>>(){
 					@Override
 					public Map<String, String>  mapRow(ResultSet rs, int rowNum) throws SQLException {
@@ -895,30 +915,38 @@ public class ReportServiceImpl implements ReportService{
 		String minfcsj="02:00";
         List<Line> lineList=lineRepository.findLineByCode(line);
         if(lineList.size()>0){
-        	String sql = "select count(*) from bsth_c_line_config where line = '"+lineList.get(0).getId()+"'";
-        	if(jdbcTemplate.queryForObject(sql, Integer.class) > 0){
+        	List<String> objList = new ArrayList<String>();
+    		objList.add(lineList.get(0).getId() + "");
+        	String sql = "select count(*) from bsth_c_line_config where line = ? ";
+        	if(jdbcTemplate.queryForObject(sql, objList.toArray(), Integer.class) > 0){
 		        String sqlMinYysj="select start_opt from bsth_c_line_config where "
 		         		+ " id = ("
-		         		+ "select max(id) from bsth_c_line_config where line ='"+lineList.get(0).getId() +"'"
+		         		+ "select max(id) from bsth_c_line_config where line = ?"
 		         		+ ")";
-		        minfcsj= jdbcTemplate.queryForObject(sqlMinYysj, String.class);
+		        minfcsj= jdbcTemplate.queryForObject(sqlMinYysj, objList.toArray(), String.class);
         	}
         }
 		String[] minSjs = minfcsj.split(":");
 		int minSj=Integer.parseInt(minSjs[0])*60+Integer.parseInt(minSjs[1]);
+		
+		List<String> objList = new ArrayList<String>();
+		objList.add(ttinfo);
+		objList.add(minfcsj);
+		objList.add(ttinfo);
+		objList.add(minfcsj);
 		//查询时间里程
 		String sqlPc=" (SELECT jhlc,fcsj,bcsj,bc_type,lp,xl_dir,ists,2 as xh FROM "
-				+ " bsth_c_s_ttinfo_detail  where  ttinfo ='"+ttinfo+"' and "
-				+ " fcsj <='"+minfcsj+"'  and bc_type!='ldks'"
+				+ " bsth_c_s_ttinfo_detail  where  ttinfo = ? and "
+				+ " fcsj <= ? and bc_type!='ldks'"
 				+ " and bc_type !='region' and bc_type !='venting' and bc_type !='major') "
 				+ " union "
 				+ " (SELECT jhlc,fcsj,bcsj,bc_type,lp,xl_dir,ists,1 as xh FROM "
-				+ " bsth_c_s_ttinfo_detail  where  ttinfo ='"+ttinfo+"'  and "
-				+ " fcsj > '"+minfcsj+"'  and bc_type!='ldks' "
+				+ " bsth_c_s_ttinfo_detail  where  ttinfo = ? and "
+				+ " fcsj > ? and bc_type!='ldks' "
 				+ " and bc_type !='region' and bc_type !='venting' and bc_type !='major') "
 				+ " order by  xh, lp,fcsj";
 		Map<String, Object> map=new HashMap<String,Object>();
-		List<Map<String, Object>> list= jdbcTemplate.query(sqlPc,
+		List<Map<String, Object>> list= jdbcTemplate.query(sqlPc, objList.toArray(),
 				new RowMapper<Map<String, Object>>(){
 					@Override
 					public Map<String, Object>  mapRow(ResultSet rs, int rowNum) throws SQLException {
@@ -1629,15 +1657,17 @@ public class ReportServiceImpl implements ReportService{
 		List<Map<String, Object>> list = new ArrayList<Map<String, Object>>();
 		String line = map.get("line").toString();
 		try {
-			String sql = "select tt.id, tt.name from bsth_c_s_ttinfo tt "
-					+ "left join bsth_c_line cl on cl.id = tt.xl "
+			List<String> objList = new ArrayList<String>();
+			String sql = "select tt.id, tt.name from bsth_c_s_ttinfo tt"
+					+ " left join bsth_c_line cl on cl.id = tt.xl"
 					+ " where tt.is_cancel = 0 and tt.is_enable_dis_template = 1";
 			if(line.length() != 0){
-				sql += " and  cl.line_code = '"+line+"'";
+				sql += " and cl.line_code = ?";
+	    		objList.add(line);
 			}
 			sql += " order by tt.create_date desc";
-			list = jdbcTemplate.query(sql,
+			list = jdbcTemplate.query(sql, objList.toArray(),
 					new RowMapper<Map<String, Object>>(){
 						@Override
 						public Map<String, Object> mapRow(ResultSet rs, int rowNum) throws SQLException {
@@ -1654,81 +1684,6 @@ public class ReportServiceImpl implements ReportService{
 		return list;
 	}
-	private List<ScheduleRealInfo> getListSinfo(Map<String, Object> map){
-		List<ScheduleRealInfo> list =new ArrayList<ScheduleRealInfo>();
-
-		String sql="select DISTINCT a.* from (select * from bsth_c_s_sp_info_real where 1=1 ";
-		if(map.get("date")!=null){
-			sql += " and schedule_date_str='"+map.get("date").toString()+"'";
-		}
-		if(map.get("line")!=null){
-			if(map.get("line").toString()!=""){
-				sql += " and xl_bm='"+map.get("line").toString()+"'";
-			}
-
-		}
-		if(map.get("bcType")!=null){
-			if(map.get("bcType").toString().equals("inout")){
-				sql += " and bc_type in ('in','out')";
-			}
-
-			if(map.get("bcType").toString().equals("normal")){
-				sql += " and bc_type not in ('in','out')";
-			}
-		}
-
-		sql += " )a left join bsth_c_s_child_task b on a.id=b.schedule";
-		list= jdbcTemplate.query(sql,
-				new RowMapper<ScheduleRealInfo>(){
-					@Override
-					public ScheduleRealInfo  mapRow(ResultSet rs, int rowNum) throws SQLException {
-						ScheduleRealInfo m=new ScheduleRealInfo();
-						m.setId(rs.getLong("id"));
-//				 m.setBcs();
-//				 m.setBcsj();
-						m.setClZbh(rs.getString("cl_zbh"));
-						m.setFcsj(rs.getString("fcsj"));
-						m.setFcsjActual(rs.getString("fcsj_actual"));
-						m.setjGh(rs.getString("j_gh"));
-						m.setjName(rs.getString("j_name"));
-						m.setJhlc(rs.getDouble("jhlc"));
-						m.setLpName(rs.getString("lp_name"));
-						m.setQdzCode(rs.getString("qdz_code"));
-						m.setQdzName(rs.getString("qdz_name"));
-						m.setRealExecDate(rs.getString("real_exec_date"));
-						m.setRealMileage(rs.getDouble("real_mileage"));
-						m.setRemarks(rs.getString("remarks"));
-						m.setsGh(rs.getString("s_gh"));
-						m.setsName(rs.getString("s_name"));
-						m.setScheduleDate(rs.getDate("schedule_date"));
-						m.setScheduleDateStr(rs.getString("schedule_date_str"));
-						m.setSflj(rs.getBoolean("sflj"));
-						m.setSpId(rs.getLong("sp_id"));
-						m.setStatus(rs.getInt("status"));
-						m.setXlBm(rs.getString("xl_bm"));
-						m.setXlDir(rs.getString("xl_dir"));
-						m.setXlName(rs.getString("xl_name"));
-						m.setZdsj(rs.getString("zdsj"));
-						m.setZdsjActual(rs.getString("zdsj_actual"));
-						m.setZdzCode(rs.getString("zdz_code"));
-						m.setZdzName(rs.getString("zdz_name"));
-						m.setCcno(rs.getInt("ccno"));
-						m.setDfAuto(rs.getBoolean("df_auto"));
-						m.setFgsBm(rs.getString("fgs_bm"));
-						m.setFgsName(rs.getString("fgs_name"));
-						m.setGsBm(rs.getString("gs_bm"));
-						m.setGsName(rs.getString("gs_name"));
-						m.setOnline(rs.getBoolean("online"));
-						m.setAdjustExps(rs.getString("adjust_exps"));
-						m.setReissue(rs.getBoolean("reissue"));
-						m.setJhlcOrig(rs.getDouble("jhlc_orig"));
-						return m;
-					}
-				});
-
-		return list;
-	}
-
 	@Override
 	public List<Map<String, Object>> jobFwqk(Map<String, Object> map) {
 		// TODO Auto-generated method stub
@@ -2202,22 +2157,6 @@ public class ReportServiceImpl implements ReportService{
 			Date dates2=cal.getTime();
 			 date2=dates2.getTime();
 			String d2=simpleDateFormat.format(dates2);
-			/*String sql="select *,UNIX_TIMESTAMP(times) as ts from bsth_c_arrival_info where times >= '"+d1 +"'and "
-					+ " times <='"+d2+"' and line_id = '"+line+"' and up_down = '"+zd+"'"
-					+ " order by device_id,times";
-
-			list =jdbcTemplate.query(sql, new RowMapper<ArrivalInfo>() {
-				@Override
-				public ArrivalInfo mapRow(ResultSet arg0, int arg1) throws SQLException {
-					ArrivalInfo ai=new ArrivalInfo();
-					ai.setInOut(arg0.getInt("in_out"));
-					ai.setDeviceId(arg0.getString("device_id"));
-					ai.setStopNo(arg0.getString("stop_no"));
-					ai.setDates(arg0.getDate("times"));
-					ai.setTs(arg0.getLong("ts")*1000);
-					return ai;
-				}
-			});*/
 			Connection conn = null;
 			PreparedStatement ps = null;
@@ -2371,11 +2310,13 @@ public class ReportServiceImpl implements ReportService{
 		String minfcsj="02:00";
         List<Line> lineList=lineRepository.findLineByCode(line);
         if(lineList.size()>0){
+        	List<String> objList = new ArrayList<String>();
+        	objList.add(lineList.get(0).getId() + "");
 	        String sqlMinYysj="select start_opt from bsth_c_line_config where "
 	         		+ " id = ("
-	         		+ "select max(id) from bsth_c_line_config where line ='"+lineList.get(0).getId() +"'"
+	         		+ "select max(id) from bsth_c_line_config where line = ?"
 	         		+ ")";
-	        minfcsj= jdbcTemplate.queryForObject(sqlMinYysj, String.class);
+	        minfcsj= jdbcTemplate.queryForObject(sqlMinYysj, objList.toArray(), String.class);
         }
 		List<ArrivalInfo> arrInfoList=this.load4(line, date, zd,minfcsj);
@@ -2940,31 +2881,28 @@ public class ReportServiceImpl implements ReportService{
 		}
 		//所有班次信息
 		List<ScheduleRealInfo> list = new ArrayList<ScheduleRealInfo>();
-		line =line.trim();
-		List<Line> lineList=lineRepository.findLineBygsBm(gsdm, fgsdm, "");
-//		if(line.equals("")){
-//			//查询所有线路
-//			list = scheduleRealInfoRepository.scheduleByDateAndLineTj(line, date,date2,gsdm,fgsdm);
-//		}else{
-			//查询单条线路
-//		list = scheduleRealInfoRepository.scheduleByDateAndLineTj2(line, date,date2);
-//		}
-			
+		line = line.trim();
+		List<String> objList = new ArrayList<String>();
+		objList.add(date);
+		objList.add(date2);
 		String sql="select r.xl_bm"
 				+ " from bsth_c_s_sp_info_real r where"
-				+ " r.schedule_date_str >=  '"+date+"' and r.schedule_date_str >= '"+date2+"'";
+				+ " r.schedule_date_str >= ? and r.schedule_date_str >= ?";
 		if(line.equals("")){
-			sql +="and r.gs_bm='"+gsdm+"' "
-					+ " and r.fgs_bm='"+fgsdm+"'";
+			sql +=" and r.gs_bm = ?"
+					+ " and r.fgs_bm = ?";
+			objList.add(gsdm);
+			objList.add(fgsdm);
 		}else{
-			sql += " and r.xl_bm = '"+line+"'";
+			sql += " and r.xl_bm = ?";
+			objList.add(line);
 		}
-		sql += " group  by  r.xl_bm";
+		sql += " group by r.xl_bm";
-		List<String> listLine=jdbcTemplate.query(sql, new RowMapper<String>() {
+		List<String> listLine=jdbcTemplate.query(sql, objList.toArray(), new RowMapper<String>() {
 			@Override
 			public String mapRow(ResultSet arg0, int arg1) throws SQLException {
 				String ve = arg0.getString("xl_bm");
@@ -3167,36 +3105,56 @@ public class ReportServiceImpl implements ReportService{
 			//查询单条线路
 			list = scheduleRealInfoRepository.scheduleByDateAndLineTj2(line, date,date2);
 		}
-		String ylbSql=" select * from bsth_c_ylb where rq BETWEEN '"+date+"' and '"+date2+"'";
+		
+		List<String> objList = new ArrayList<String>();
+		objList.add(date);
+		objList.add(date2);
+		String ylbSql=" select * from bsth_c_ylb where rq BETWEEN ? and ?";
 		if(line.equals("")){
-			ylbSql +="and ssgsdm='"+gsdm+"' "
-					+ " and fgsdm='"+fgsdm+"'";
+			ylbSql +=" and ssgsdm = ?"
+					+ " and fgsdm = ?";
+			objList.add(gsdm);
+			objList.add(fgsdm);
 		}else{
-			ylbSql += " and xlbm = '"+line+"'";
+			ylbSql += " and xlbm = ?";
+			objList.add(line);
 		}
-		List<Ylb> ylbList=ylbList(ylbSql);
-		String dlbSql=" select * from bsth_c_dlb where rq BETWEEN '"+date+"' and '"+date2+"'";
+		List<Ylb> ylbList = ylbList(ylbSql, objList);
+		
+		List<String> objList2 = new ArrayList<String>();
+		objList2.add(date);
+		objList2.add(date2);
+		String dlbSql=" select * from bsth_c_dlb where rq BETWEEN ? and ?";
 		if(line.equals("")){
-			dlbSql +="and ssgsdm='"+gsdm+"' "
-					+ " and fgsdm='"+fgsdm+"'";
+			dlbSql +=" and ssgsdm = ?"
+					+ " and fgsdm = ?";
+			objList2.add(gsdm);
+			objList2.add(fgsdm);
 		}else{
-			dlbSql += " and xlbm = '"+line+"'";
+			dlbSql += " and xlbm = ?";
+			objList2.add(line);
 		}
-		List<Dlb> dlbList=dlbList(dlbSql);
+		List<Dlb> dlbList=dlbList(dlbSql, objList2);
 		List<Map<String, Object>> listGroupBy =null;
 		String sql="";
 		if(zt.equals("zbh")){
+			List<String> objList3 = new ArrayList<String>();
+			objList3.add(date);
+			objList3.add(date2);
 			sql+="select r.xl_bm,r.cl_zbh"
 					+ " from bsth_c_s_sp_info_real r where"
-					+ " r.schedule_date_str BETWEEN  '"+date+"' and '"+date2+"'";
+					+ " r.schedule_date_str BETWEEN ? and ?";
 			if(line.equals("")){
-				sql +="and r.gs_bm='"+gsdm+"' "
-						+ " and r.fgs_bm='"+fgsdm+"'";
+				sql +=" and r.gs_bm = ?"
+						+ " and r.fgs_bm = ?";
+				objList3.add(gsdm);
+				objList3.add(fgsdm);
 			}else{
-				sql += " and r.xl_bm = '"+line+"'";
+				sql += " and r.xl_bm = ?";
+				objList3.add(line);
 			}
-			sql += " group  by  r.xl_bm,r.cl_zbh";
-			listGroupBy=jdbcTemplate.query(sql, new RowMapper<Map<String, Object>>() {
+			sql += " group by r.xl_bm,r.cl_zbh";
+			listGroupBy=jdbcTemplate.query(sql, objList3.toArray(), new RowMapper<Map<String, Object>>() {
 				@Override
 				public Map<String, Object> mapRow(ResultSet arg0, int arg1) throws SQLException {
 					Map<String, Object> map=new HashMap<String,Object>();
@@ -3206,17 +3164,23 @@ public class ReportServiceImpl implements ReportService{
 				}
 			});
 		}else{
+			List<String> objList4 = new ArrayList<String>();
+			objList4.add(date);
+			objList4.add(date2);
 			sql+="select r.xl_bm,r.cl_zbh,r.j_gh,r.s_gh"
 					+ " from bsth_c_s_sp_info_real r where"
-					+ " r.schedule_date_str BETWEEN  '"+date+"' and '"+date2+"'";
+					+ " r.schedule_date_str BETWEEN ? and ?";
 			if(line.equals("")){
-				sql +="and r.gs_bm='"+gsdm+"' "
-						+ " and r.fgs_bm='"+fgsdm+"'";
+				sql +=" and r.gs_bm = ? "
+						+ " and r.fgs_bm = ?";
+				objList4.add(gsdm);
+				objList4.add(fgsdm);
 			}else{
-				sql += " and r.xl_bm = '"+line+"'";
+				sql += " and r.xl_bm = ?";
+				objList4.add(line);
 			}
-			sql += " group  by  r.xl_bm,r.cl_zbh,r.j_gh,r.s_gh";
-			listGroupBy=jdbcTemplate.query(sql, new RowMapper<Map<String, Object>>() {
+			sql += " group by r.xl_bm,r.cl_zbh,r.j_gh,r.s_gh";
+			listGroupBy=jdbcTemplate.query(sql, objList4.toArray(), new RowMapper<Map<String, Object>>() {
 				@Override
 				public Map<String, Object> mapRow(ResultSet arg0, int arg1) throws SQLException {
 					Map<String, Object> map=new HashMap<String,Object>();
@@ -3231,8 +3195,6 @@ public class ReportServiceImpl implements ReportService{
 			});
 		}
-
-	
 		for (int i = 0; i < listGroupBy.size(); i++) {
 			Map<String, Object> m=listGroupBy.get(i);
@@ -3392,8 +3354,8 @@ public class ReportServiceImpl implements ReportService{
 		return lMap;
 	}
-	public final List<Ylb> ylbList(String sql){
-		List<Ylb> ylbList= jdbcTemplate.query(sql, new RowMapper<Ylb>() {
+	public final List<Ylb> ylbList(String sql, List<String> objList){
+		List<Ylb> ylbList= jdbcTemplate.query(sql, objList.toArray(), new RowMapper<Ylb>() {
 			@Override
 			public Ylb mapRow(ResultSet arg0, int arg1) throws SQLException {
 				Ylb y = new Ylb();
@@ -3411,8 +3373,8 @@ public class ReportServiceImpl implements ReportService{
 		return ylbList;
 	}
-	public final List<Dlb> dlbList(String sql){
-		List<Dlb> dlbList= jdbcTemplate.query(sql, new RowMapper<Dlb>() {
+	public final List<Dlb> dlbList(String sql, List<String> objList){
+		List<Dlb> dlbList= jdbcTemplate.query(sql, objList.toArray(), new RowMapper<Dlb>() {
 			@Override
 			public Dlb mapRow(ResultSet arg0, int arg1) throws SQLException {
 				Dlb y = new Dlb();
@@ -3562,15 +3524,19 @@ public class ReportServiceImpl implements ReportService{
 		}
 		SimpleDateFormat sdf=new SimpleDateFormat("yyyy-MM-dd HH:mm");
 // 			 Collections.sort(listInfo,new ComparableAcuals());
+		
+		List<String> objList = new ArrayList<String>();
 		//查询所有线路
 		String xlSql="select line_code,spac_grade from bsth_c_line ";
 		if(line.equals("")){
-			xlSql +=" where company ='"+gsbm+"'";
+			xlSql +=" where company = ?";
+			objList.add(gsbm);
 		}else{
-			xlSql +=" where line_code ='"+line+"'";
+			xlSql +=" where line_code = ?";
+			objList.add(line);
 		}
-		List<Map<String, Object>> xlList=jdbcTemplate.query(xlSql, new RowMapper<Map<String, Object>>() {
+		List<Map<String, Object>> xlList=jdbcTemplate.query(xlSql, objList.toArray(), new RowMapper<Map<String, Object>>() {
 			@Override
 			public Map<String, Object> mapRow(ResultSet arg0, int arg1) throws SQLException {
 				Map<String, Object> map=new HashMap<String,Object>();
@@ -3815,10 +3781,14 @@ public class ReportServiceImpl implements ReportService{
 		String line =map.get("line").toString();
 		String date =map.get("date").toString();
 		String type =map.get("type").toString();
-		DecimalFormat  df   = new DecimalFormat("#0.00");
+		DecimalFormat df = new DecimalFormat("#0.00");
+		
+		List<String> objList = new ArrayList<String>();
+		objList.add(date);
+		objList.add(line);
 		String sql="select cl_zbh from bsth_c_s_sp_info_real where "
-				+ " schedule_date_str ='"+date+"' and xl_bm='"+line+"' group by cl_zbh";
-		List<String> list= jdbcTemplate.query(sql,
+				+ " schedule_date_str = ? and xl_bm = ? group by cl_zbh";
+		List<String> list= jdbcTemplate.query(sql, objList.toArray(),
 				new RowMapper<String>(){
 					@Override
 					public String  mapRow(ResultSet rs, int rowNum) throws SQLException {
@@ -3954,23 +3924,29 @@ public class ReportServiceImpl implements ReportService{
 		List<Singledata> list=new ArrayList<Singledata>();
 		List<Singledata> list_=new ArrayList<Singledata>();
 		if(tjtype.equals("jsy")){
+			List<String> objList = new ArrayList<String>();
+			objList.add(startDate);
+			objList.add(endDate);
 			//油统计
 			String sql="select r.j_gh, r.xl_bm,r.cl_zbh,r.fgs_bm"
 					+ " from bsth_c_s_sp_info_real r where "
-					+ " r.schedule_date_str >= '"+startDate+"'"
-					+ " and r.schedule_date_str<='"+endDate+"'";
+					+ " r.schedule_date_str >= ?"
+					+ " and r.schedule_date_str <= ?";
 			if(xlbm.length() != 0){
-				sql += " and r.xl_bm = '"+xlbm+"'";
+				sql += " and r.xl_bm = ?";
+				objList.add(xlbm);
 			}
 			if(gsdm.length() != 0){
-				sql += " and r.gs_bm ='"+gsdm+"'";
+				sql += " and r.gs_bm = ?";
+				objList.add(gsdm);
 			}
 			if(fgsdm.length() != 0){
-				sql += " and r.fgs_bm ='"+fgsdm+"'";
+				sql += " and r.fgs_bm = ?";
+				objList.add(fgsdm);
 			}
-		    sql += " group  by  r.j_gh,r.xl_bm,r.cl_zbh,r.fgs_bm order by r.xl_bm,r.cl_zbh";
+		    sql += " group by r.j_gh,r.xl_bm,r.cl_zbh,r.fgs_bm order by r.xl_bm,r.cl_zbh";
-		    list = jdbcTemplate.query(sql, new RowMapper<Singledata>() {
+		    list = jdbcTemplate.query(sql, objList.toArray(), new RowMapper<Singledata>() {
 				@Override
 				public Singledata mapRow(ResultSet arg0, int arg1) throws SQLException {
 					Singledata sin = new Singledata();
@@ -3982,39 +3958,44 @@ public class ReportServiceImpl implements ReportService{
 				}
 			});
-		    
+		    List<String> objList2 = new ArrayList<String>();
+		    List<String> tempList2 = new ArrayList<String>();
+		    tempList2.add(startDate);
+		    tempList2.add(endDate);
 		    String linesql="";
 		    if(!xlbm.equals("")){
-		    	linesql +=" and xlbm ='"+xlbm+"' ";
+		    	linesql +=" and xlbm = ?";
+		    	tempList2.add(xlbm);
 		    }
 		    if(!gsdm.equals("")){
-		    	linesql +=" and ssgsdm ='"+gsdm+"' ";
+		    	linesql +=" and ssgsdm = ?";
+		    	tempList2.add(gsdm);
 		    }
 		    if(!fgsdm.equals("")){
-		    	linesql +=" and fgsdm ='"+fgsdm+"' ";
+		    	linesql +=" and fgsdm = ?";
+		    	tempList2.add(fgsdm);
+		    }
+		    
+		    for(int i = 0; i < 2; i++){ // sql中使用两次重复参数
+		    	for(String s : tempList2){
+		    		objList2.add(s);
+		    	}
 		    }
-			/*String nysql="SELECT id,xlbm,nbbm,jsy,jzl as jzl,yh as yh,sh as sh,fgsdm FROM bsth_c_ylb"
-					+ " WHERE rq >= '"+startDate+"' and rq <='"+endDate+"'"
-					+ linesql
-					+ " union"
-					+ "  SELECT id,xlbm,nbbm,jsy,cdl as jzl,hd as yh,sh as sh,fgsdm FROM bsth_c_dlb"
-					+ " WHERE rq = '"+startDate+"' and rq <='"+endDate+"'"
-					+ linesql;*/
 		    String nysql="SELECT 'yh' as type,xlbm,nbbm,jsy,sum(jzl*1000)/1000 as jzl,"
 		    		+ " sum(yh*1000)/1000 as yh,"
 		    		+ " sum(sh*1000)/1000 as sh FROM "
-		    		+ "bsth_c_ylb  where  rq>='"+startDate+"' "
-		    		+ " and rq <='"+endDate+"' " +linesql
+		    		+ "bsth_c_ylb where rq >= ? "
+		    		+ " and rq <= ? " +linesql
 		    		+ " group by xlbm ,nbbm,jsy "
 		    		+ " union SELECT 'dh' as type,xlbm,nbbm,jsy, "
 		    		+ " sum(cdl*1000)/1000 as jzl,sum(hd*1000)/1000 as yh,"
 		    		+ " sum(sh * 1000) / 1000 AS sh"
-		    		+ " FROM  bsth_c_dlb where rq>='"+startDate+"' "
-		    		+ " and rq <='"+endDate+"'" +linesql
+		    		+ " FROM  bsth_c_dlb where rq >= ? "
+		    		+ " and rq <= ? " +linesql
 		    		+ " group by xlbm ,nbbm,jsy" ;
-			List<Singledata> listNy = jdbcTemplate.query(nysql, new RowMapper<Singledata>() {
+			List<Singledata> listNy = jdbcTemplate.query(nysql, objList2.toArray(), new RowMapper<Singledata>() {
 				@Override
 				public Singledata mapRow(ResultSet arg0, int arg1) throws SQLException {
 					Singledata sin = new Singledata();
@@ -4141,25 +4122,31 @@ public class ReportServiceImpl implements ReportService{
 			}
 		}else{
+			List<String> objList3 = new ArrayList<String>();
+			objList3.add(startDate);
+			objList3.add(endDate);
 			String sql="select r.s_gh,r.s_name, "
 					+ " r.xl_bm,r.cl_zbh,r.gs_bm,r.fgs_bm"
 					+ " from bsth_c_s_sp_info_real r where "
-					+ " r.schedule_date_str >= '"+startDate+"'"
-					+ " schedule_date_str <='"+endDate+"'"
+					+ " r.schedule_date_str >= ?"
+					+ " schedule_date_str <= ?"
 					+ " and r.s_gh !='' and r.s_gh is not null ";
 			if(!xlbm.equals("")){
-				sql += " and r.xl_bm = '"+xlbm+"'";
+				sql += " and r.xl_bm = ?";
+				objList3.add(xlbm);
 			}
 			if(!gsdm.equals("")){
-				sql += " and r.gs_bm = '"+gsdm+"'";
+				sql += " and r.gs_bm = ?";
+				objList3.add(gsdm);
 			}
 			if(!fgsdm.equals("")){
-				sql += " and r.fgs_bm = '"+fgsdm+"'";
+				sql += " and r.fgs_bm = ?";
+				objList3.add(fgsdm);
 			}
-		    sql += " group  by  r.s_gh,r.s_name,"
+		    sql += " group by r.s_gh,r.s_name,"
 		       		+ " r.xl_bm,r.cl_zbh,r.gs_bm,r.fgs_bm order by r.xl_bm,r.cl_zbh";
-			list = jdbcTemplate.query(sql, new RowMapper<Singledata>() {
+			list = jdbcTemplate.query(sql, objList3.toArray(), new RowMapper<Singledata>() {
 				//SimpleDateFormat sdf = new SimpleDateFormat("yyyy-MM-dd");
 				@Override
 				public Singledata mapRow(ResultSet arg0, int arg1) throws SQLException {
@@ -4237,29 +4224,9 @@ public class ReportServiceImpl implements ReportService{
 			}
 		}
-		/*Map<String, Boolean> lineNature = lineService.lineNature();
-		List<Singledata> resList = new ArrayList<Singledata>();
-		for(Singledata s : list_){
-			String xlBm = s.getxL();
-			if(sfyy.length() != 0){
-				if(sfyy.equals("0")){
-					resList.add(s);
-				} else if(sfyy.equals("1")){
-					if(lineNature.containsKey(xlBm) && lineNature.get(xlBm)){
-						resList.add(s);
-					}
-				} else {
-					if(lineNature.containsKey(xlBm) && !lineNature.get(xlBm)){
-						resList.add(s);
-					}
-				}
-			} else {
-				resList.add(s);
-			}
-		}*/
-		 if (type.equals("export")) {
+		if (type.equals("export")) {
 		        List<Iterator<?>> listI = new ArrayList<Iterator<?>>();
 		        ReportUtils ee = new ReportUtils();
@@ -4340,22 +4307,27 @@ public class ReportServiceImpl implements ReportService{
 			listReal=scheduleRealInfoRepository.scheduleByDateAndLineQp(xlbm,  date);
 		}
+		List<String> objList = new ArrayList<String>();
+		objList.add(date);
 		String sql="select r.j_gh, r.xl_bm,r.cl_zbh,r.lp_name "
 				+ " from bsth_c_s_sp_info_real r where "
-				+ " r.schedule_date_str = '"+date+"'";
+				+ " r.schedule_date_str = ?";
 		if(xlbm.length() != 0){
-			sql += " and r.xl_bm = '"+xlbm+"'";
+			sql += " and r.xl_bm = ?";
+			objList.add(xlbm);
 		}
 		if(gsdm.length() != 0){
-			sql += " and r.gs_bm ='"+gsdm+"'";
+			sql += " and r.gs_bm = ?";
+			objList.add(gsdm);
 		}
 		if(fgsdm.length() != 0){
-			sql += " and r.fgs_bm ='"+fgsdm+"'";
+			sql += " and r.fgs_bm = ?";
+			objList.add(fgsdm);
 		}
-	    sql += " group  by  r.j_gh,r.xl_bm,r.cl_zbh,r.lp_name order by r.xl_bm,r.cl_zbh,r.lp_name";
+	    sql += " group by r.j_gh,r.xl_bm,r.cl_zbh,r.lp_name order by r.xl_bm,r.cl_zbh,r.lp_name";
-	    List<Map<String, Object>> list = jdbcTemplate.query(sql, new RowMapper<Map<String,Object>>() {
+	    List<Map<String, Object>> list = jdbcTemplate.query(sql, objList.toArray(), new RowMapper<Map<String,Object>>() {
 			@Override
 			public Map<String, Object> mapRow(ResultSet arg0, int arg1) throws SQLException {
 				Map<String, Object> m=new HashMap<String, Object>();
@@ -4425,22 +4397,27 @@ public class ReportServiceImpl implements ReportService{
 		}
 	    List<Map<String, Object>> listAll=new ArrayList<Map<String,Object>>();
 		if(energy.equals("1")){
+			List<String> objList1 = new ArrayList<String>();
+			objList1.add(date);
 			//油统计
 			String ylbSql="select ssgsdm,fgsdm,xlbm,nbbm,jsy,ifnull(lp,'') as lp,czlc,"
 					+ " czyl,jzl,jzlc,jzyl,yh,sh,shyy,rylx,ns,zlc,linename,jname "
-					+ "  from bsth_c_ylb where rq='"+date+"'";
+					+ "  from bsth_c_ylb where rq = ?";
 			if(xlbm.length() != 0){
-				ylbSql += " and xlbm = '"+xlbm+"'";
+				ylbSql += " and xlbm = ?";
+				objList1.add(xlbm);
 			}
 			if(gsdm.length() != 0){
-				ylbSql += " and ssgsdm ='"+gsdm+"'";
+				ylbSql += " and ssgsdm = ?";
+				objList1.add(gsdm);
 			}
 			if(fgsdm.length() != 0){
-				ylbSql += " and fgsdm ='"+fgsdm+"'";
+				ylbSql += " and fgsdm = ?";
+				objList1.add(fgsdm);
 			}
 			ylbSql += " order by xlbm,nbbm,jcsx";
-			listAll = jdbcTemplate.query(ylbSql, new RowMapper<Map<String,Object>>() {
+			listAll = jdbcTemplate.query(ylbSql, objList1.toArray(), new RowMapper<Map<String,Object>>() {
 					@Override
 					public Map<String, Object> mapRow(ResultSet arg0, int arg1) throws SQLException {
 						Map<String, Object> m=new HashMap<String, Object>();
@@ -4476,21 +4453,26 @@ public class ReportServiceImpl implements ReportService{
 				});
 		}else{
+			List<String> objList2 = new ArrayList<String>();
+			objList2.add(date);
 			//电统计
 			String dlbSql="select ssgsdm,fgsdm,xlbm,nbbm,jsy,ifnull(lp,'') as lp,czlc,"
 					+ " czcd,cdl,jzlc,jzcd,hd,sh,shyy,ns,zlc,linename,jname "
-					+ "  from bsth_c_dlb where rq='"+date+"'";
+					+ "  from bsth_c_dlb where rq = ?";
 			if(xlbm.length() != 0){
-				dlbSql += " and xlbm = '"+xlbm+"'";
+				dlbSql += " and xlbm = ?";
+				objList2.add(xlbm);
 			}
 			if(gsdm.length() != 0){
-				dlbSql += " and ssgsdm ='"+gsdm+"'";
+				dlbSql += " and ssgsdm = ?";
+				objList2.add(gsdm);
 			}
 			if(fgsdm.length() != 0){
-				dlbSql += " and fgsdm ='"+fgsdm+"'";
+				dlbSql += " and fgsdm = ?";
+				objList2.add(fgsdm);
 			}
 			dlbSql += " order by xlbm,nbbm,jcsx";
-			listAll = jdbcTemplate.query(dlbSql, new RowMapper<Map<String,Object>>() {
+			listAll = jdbcTemplate.query(dlbSql, objList2.toArray(), new RowMapper<Map<String,Object>>() {
 					@Override
 					public Map<String, Object> mapRow(ResultSet arg0, int arg1) throws SQLException {
 						Map<String, Object> m=new HashMap<String, Object>();