改掉sql拼接（sql注入漏洞）。

娄高锋
1 parent def55653
Showing 1 changed file with 130 additions and 55 deletions
src/main/java/com/bsth/service/schedule/impl/PeopleCarPlanServiceImpl.java
@@ -46,18 +46,27 @@ public class PeopleCarPlanServiceImpl implements PeopleCarPlanService {
 		List<ScheduleRealInfo> list = new ArrayList<ScheduleRealInfo>();
 		try {
-			String sql = "select * from bsth_c_s_sp_info_real where schedule_date_str = '"+date+"'";
+			List<String> objList = new ArrayList<String>();
+			String sql = "select * from bsth_c_s_sp_info_real where schedule_date_str = ?";
+			objList.add(date);
-			if(line.length() != 0)
-				sql += " and xl_bm = '"+line+"'";
-			if(company.length() != 0)
-				sql += " and gs_bm = '"+company+"'";
-			if(subCompany.length() != 0)
-				sql += " and fgs_bm = '"+subCompany+"'";
+			if(line.length() != 0){
+				sql += " and xl_bm = ?";
+				objList.add(line);
+			}
+			if(company.length() != 0){
+				sql += " and gs_bm = ?";
+				objList.add(company);
+			}
+			if(subCompany.length() != 0){
+				sql += " and fgs_bm = ?";
+				objList.add(subCompany);
+			}
 			sql += " order by gs_bm, fgs_bm, xl_bm";
 			list = jdbcTemplate.query(sql,
+					objList.toArray(),
 					new RowMapper<ScheduleRealInfo>(){
 				@Override
 				public ScheduleRealInfo mapRow(ResultSet rs, int rowNum) throws SQLException {
@@ -193,17 +202,25 @@ public class PeopleCarPlanServiceImpl implements PeopleCarPlanService {
 		}
 		try {
-
-			String sql = "select * from bsth_c_s_sp_info where schedule_date = '"+date+"'";
+			List<String> objList = new ArrayList<String>();
+			String sql = "select * from bsth_c_s_sp_info where schedule_date = ?";
+			objList.add(date);
+			
 			if(line.length() != 0){
-				sql += " and xl_bm = '"+line+"'";
+				sql += " and xl_bm = ?";
+				objList.add(line);
+			}
+			if(company.length() != 0){
+				sql += " and gs_bm = ?";
+				objList.add(company);
+			}
+			if(subCompany.length() != 0){
+				sql += " and fgs_bm = ?";
+				objList.add(subCompany);
 			}
-			if(company.length() != 0)
-				sql += " and gs_bm = '"+company+"'";
-			if(subCompany.length() != 0)
-				sql += " and fgs_bm = '"+subCompany+"'";
 			list = jdbcTemplate.query(sql,
+					objList.toArray(),
 					new RowMapper<SchedulePlanInfo>(){
 				@Override
 				public SchedulePlanInfo mapRow(ResultSet rs, int rowNum) throws SQLException {
@@ -609,19 +626,25 @@ public class PeopleCarPlanServiceImpl implements PeopleCarPlanService {
 			endDate = new SimpleDateFormat("yyyy-MM-dd").format(new Date());
 		}
 		try {
-
+			List<String> objList = new ArrayList<String>();
 			String sql = "select schedule_date_str,xl_name,bc_type,gs_name,fgs_name,fgs_bm,bcs,"
 					+"fcno,fcsj,fcsj_actual,zdsj,zdsj_actual,bcsj,qdz_name,sp_id,cc_service"
-					+" from bsth_c_s_sp_info_real where schedule_date_str >= '"+startDate
-					+"' and schedule_date_str <= '"+endDate+"'";
+					+" from bsth_c_s_sp_info_real where schedule_date_str >= ?"
+					+" and schedule_date_str <= ?";
+			objList.add(startDate);
+			objList.add(endDate);
+			
 			if(line.length() != 0){
-				sql += " and xl_bm = '"+line+"'";
+				sql += " and xl_bm = ?";
+				objList.add(line);
 			}
 			if(company.length() != 0){
-				sql += " and gs_bm = '"+company+"'";
+				sql += " and gs_bm = ?";
+				objList.add(company);
 			}
 			if(subCompany.length() != 0){
-				sql += " and fgs_bm = '"+subCompany+"'";
+				sql += " and fgs_bm = ?";
+				objList.add(subCompany);
 			}
 			sql += " and bc_type != 'in' and bc_type != 'out' and bc_type != 'ldks'";
 			if(Integer.valueOf(bcType) == 1){
@@ -630,6 +653,7 @@ public class PeopleCarPlanServiceImpl implements PeopleCarPlanService {
 				sql += " and bc_type = 'region'";
 			}
 			list = jdbcTemplate.query(sql,
+					objList.toArray(),
 					new RowMapper<ScheduleRealInfo>(){
 				@Override
 				public ScheduleRealInfo mapRow(ResultSet rs, int rowNum) throws SQLException {
@@ -923,19 +947,26 @@ public class PeopleCarPlanServiceImpl implements PeopleCarPlanService {
 			endDate = new SimpleDateFormat("yyyy-MM-dd").format(new Date());
 		}
 		try {
-
-			String sql = "select * from bsth_c_s_sp_info_real where schedule_date_str >= '"+startDate+"' and schedule_date_str <= '"+endDate+"'";
+			List<String> objList = new ArrayList<String>();
+			String sql = "select * from bsth_c_s_sp_info_real where schedule_date_str >= ? and schedule_date_str <= ?";
+			objList.add(startDate);
+			objList.add(endDate);
+			
 			if(line.length() != 0){
-				sql += " and xl_bm = '"+line+"'";
+				sql += " and xl_bm = ?";
+				objList.add(line);
 			}
 			if(nbbm.length() != 0){
-				sql += " and cl_zbh like '%"+nbbm+"%'";
+				sql += " and cl_zbh like ?";
+				objList.add("%" + nbbm + "%");
 			}
 			if(company.length() != 0){
-				sql += " and gs_bm like '"+company+"'";
+				sql += " and gs_bm = ?";
+				objList.add(company);
 			}
 			if(subCompany.length() != 0){
-				sql += " and fgs_bm like '"+subCompany+"'";
+				sql += " and fgs_bm = ?";
+				objList.add(subCompany);
 			}
 			sql += " and bc_type != 'in' and bc_type != 'out' and bc_type != 'ldks'";
 			if(bcType.trim().equals("1")){
@@ -945,6 +976,7 @@ public class PeopleCarPlanServiceImpl implements PeopleCarPlanService {
 			}
 			list = jdbcTemplate.query(sql,
+					objList.toArray(),
 					new RowMapper<ScheduleRealInfo>(){
 				@Override
 				public ScheduleRealInfo mapRow(ResultSet rs, int rowNum) throws SQLException {
@@ -1214,20 +1246,28 @@ public class PeopleCarPlanServiceImpl implements PeopleCarPlanService {
 			isCancel = map.get("isCancel").toString().trim();
 		}
 		try {
+			List<String> objList = new ArrayList<String>();
 			String sql = "select tt.id, tt.name from bsth_c_s_ttinfo tt left join" +
 					" (select tt_info from bsth_c_s_sp_info where 1=1";
-			if(startDate.trim().length() > 0)
-				sql += " and schedule_date >= '"+startDate+"'";
-			if(endDate.trim().length() > 0)
-				sql += " and schedule_date <= '"+endDate+"'";
+			
+			if(startDate.trim().length() > 0){
+				sql += " and schedule_date >= ?";
+				objList.add(startDate);
+			}
+			if(endDate.trim().length() > 0){
+				sql += " and schedule_date <= ?";
+				objList.add(endDate);
+			}
 			if(line.trim().length() != 0){
-				sql += " and xl_bm = '"+line+"'";
+				sql += " and xl_bm = ?";
+				objList.add(line);
 			} else {
 				return resList;
 			}
 			sql += " ) sp on sp.tt_info = tt.id where sp.tt_info is not null group by tt.id, tt.name";
 			resList = jdbcTemplate.query(sql,
+					objList.toArray(),
 					new RowMapper<Map<String, Object>>(){
 				@Override
 				public Map<String, Object> mapRow(ResultSet rs, int rowNum) throws SQLException {
@@ -1269,19 +1309,29 @@ public class PeopleCarPlanServiceImpl implements PeopleCarPlanService {
 			date = sdf.format(new Date());
 		try {
+			List<String> objList = new ArrayList<String>();
 			String sql = "select a.schedule_date_str, a.real_exec_date, a.xl_name, a.fcsj, a.fcsj_actual, a.zdsj, a.zdsj_actual, a.qdz_name, a.zdz_name, a.xl_dir, a.status, a.gs_name, a.fgs_name,"
 					+ " a.xl_bm, a.fgs_bm, a.cc_service, (select start_opt from bsth_c_line_config where id ="
 					+ " (select max(id) from bsth_c_line_config where line = (select id from bsth_c_line where line_code = a.xl_bm))) start_opt"
-					+ " from bsth_c_s_sp_info_real a where schedule_date_str = '"+date+"'"
+					+ " from bsth_c_s_sp_info_real a where schedule_date_str = ?"
 					+ " and bc_type != 'in' and bc_type != 'out' and bc_type != 'ldks' and bc_type != 'region'";
-			if(line.trim().length() != 0)
-				sql += " and xl_bm = '"+line+"'";
-			if(company.length() != 0)
-				sql += " and gs_bm = '"+company+"'";
-			if(subCompany.length() != 0)
-				sql += " and fgs_bm = '"+subCompany+"'";
+			objList.add(date);
+			
+			if(line.trim().length() != 0){
+				sql += " and xl_bm = ?";
+				objList.add(line);
+			}
+			if(company.length() != 0){
+				sql += " and gs_bm = ?";
+				objList.add(company);
+			}
+			if(subCompany.length() != 0){
+				sql += " and fgs_bm = ?";
+				objList.add(subCompany);
+			}
 			list = jdbcTemplate.query(sql,
+					objList.toArray(),
 					new RowMapper<ScheduleRealInfo>(){
 				@Override
 				public ScheduleRealInfo mapRow(ResultSet rs, int rowNum) throws SQLException {
@@ -1541,19 +1591,30 @@ public class PeopleCarPlanServiceImpl implements PeopleCarPlanService {
 		}
 		try {
+			List<String> objList = new ArrayList<String>();
 			String sql = "select a.schedule_date_str, a.real_exec_date, a.xl_bm, a.xl_name, a.fcsj, a.fcsj_actual, a.zdsj, a.zdsj_actual, a.qdz_name, a.zdz_name, a.xl_dir, a.status, a.gs_name, a.fgs_name,"
 					+ " a.fgs_bm, a.cc_service, a.remarks, a.adjust_exps, (select start_opt from bsth_c_line_config where id = "
 					+ " (select max(id) from bsth_c_line_config where line = (select id from bsth_c_line where line_code = a.xl_bm))) start_opt"
-					+ " from bsth_c_s_sp_info_real a where schedule_date_str >= '"+startDate+"' and schedule_date_str <= '"+endDate+"'"
+					+ " from bsth_c_s_sp_info_real a where schedule_date_str >= ? and schedule_date_str <= ?"
 					+ " and bc_type != 'in' and bc_type != 'out' and bc_type != 'ldks' and bc_type != 'region'";
-			if(line.length() != 0)
-				sql += " and xl_bm = '"+line+"'";
-			if(company.length() != 0)
-				sql += " and gs_bm = '"+company+"'";
-			if(subCompany.length() != 0)
-				sql += " and fgs_bm = '"+subCompany+"'";
+			objList.add(startDate);
+			objList.add(endDate);
+			
+			if(line.length() != 0){
+				sql += " and xl_bm = ?";
+				objList.add(line);
+			}
+			if(company.length() != 0){
+				sql += " and gs_bm = ?";
+				objList.add(company);
+			}
+			if(subCompany.length() != 0){
+				sql += " and fgs_bm = ?";
+				objList.add(subCompany);
+			}
 			list = jdbcTemplate.query(sql,
+					objList.toArray(),
 					new RowMapper<ScheduleRealInfo>(){
 				@Override
 				public ScheduleRealInfo mapRow(ResultSet rs, int rowNum) throws SQLException {
@@ -2159,24 +2220,30 @@ public class PeopleCarPlanServiceImpl implements PeopleCarPlanService {
 //		String code = map.get("code").toString();
 		String type = map.get("type").toString();
+		List<String> objList = new ArrayList<String>();
 		String sql_="select * from bsth_c_s_sp_info_real "
-				+ " WHERE schedule_date_str = '"+date+"' ";
+				+ " WHERE schedule_date_str = ? ";
+		objList.add(date);
+		
 		if(!line.equals("")){
-			sql_ += " and xl_bm = '"+line+"'";
+			sql_ += " and xl_bm = ?";
+			objList.add(line);
 		}
 		if(company.length() != 0){
-			sql_ += " and gs_bm='"+company+"'";
+			sql_ += " and gs_bm = ?";
+			objList.add(company);
 		}
 		if(subCompany.length() != 0){
-			sql_ += " and fgs_bm='"+subCompany+"'";
+			sql_ += " and fgs_bm = ?";
+			objList.add(subCompany);
 		}
-		
 		String sql="SELECT r.id,r.schedule_date_str,r.xl_name,r.xl_bm,r.cl_zbh,r.j_gh,r.j_name,r.fcsj,"
 				+ " r.gs_name,r.fgs_name,CONCAT(r.xl_bm,'_',r.id) as line_sch FROM ("+sql_+") AS r"
 				+ " order by r.gs_bm,r.fgs_bm,r.xl_bm,r.id ";
 		List<Map<String, Object>> tempList = jdbcTemplate.query(sql,
+				objList.toArray(),
 				new RowMapper<Map<String, Object>>(){
 			@Override
 			public Map<String, Object> mapRow(ResultSet rs, int rowNum) throws SQLException {
@@ -2381,14 +2448,18 @@ public class PeopleCarPlanServiceImpl implements PeopleCarPlanService {
 //		String code = map.get("code").toString();
 		String type = map.get("type").toString();
+		List<String> objList = new ArrayList<String>();
 		String sql_="select * from bsth_c_s_sp_info_real "
-				+ " WHERE schedule_date_str = '"+date+"' and xl_bm = '"+line+"'";
+				+ " WHERE schedule_date_str = ? and xl_bm = ?";
+		objList.add(date);
+		objList.add(line);
 		String sql="SELECT r.id,r.schedule_date_str,r.xl_name,r.xl_bm,r.cl_zbh,r.j_gh,r.j_name,r.fcsj,"
 				+ " r.gs_name,r.fgs_name,CONCAT(r.xl_bm,'_',r.id) as gh_sch FROM ("+sql_+") AS r"
 				+ " order by r.xl_name,r.id ";
 		List<Map<String, Object>> list = jdbcTemplate.query(sql,
+				objList.toArray(),
 				new RowMapper<Map<String, Object>>(){
 			@Override
 			public Map<String, Object> mapRow(ResultSet rs, int rowNum) throws SQLException {
@@ -2586,14 +2657,17 @@ public class PeopleCarPlanServiceImpl implements PeopleCarPlanService {
 		if(map.get("type")!=null)
 			type = map.get("type").toString().trim();
-		String sql_="select * from bsth_c_s_sp_info_real "
-				+ " WHERE schedule_date_str = '"+date+"'  and j_gh = '"+jgh+"'";
+		List<String> objList = new ArrayList<String>();
+		String sql_ = "select * from bsth_c_s_sp_info_real "
+				+ " WHERE schedule_date_str = ? and j_gh = ?";
+		objList.add(date);
+		objList.add(jgh);
 		if(!line.equals("")){
-			sql_ +=" and xl_bm = '"+line+"'";
+			sql_ +=" and xl_bm = ?";
+			objList.add(line);
 		}
-		
 		String sql="SELECT r.id,r.schedule_date_str,r.fcsj,r.xl_name,r.xl_bm,r.cl_zbh,r.j_gh,r.j_name,"
 				+ " r.fcsj,d. TIMESTAMP,d.reply46,d.reply47,d.reply46time,d.reply47time,"
 				+ " r.gs_name,r.fgs_name  FROM ("+sql_+") "
@@ -2602,6 +2676,7 @@ public class PeopleCarPlanServiceImpl implements PeopleCarPlanService {
 		List<Map<String, Object>> list = jdbcTemplate.query(sql,
+				objList.toArray(),
 				new RowMapper<Map<String, Object>>(){
 			@Override
 			public Map<String, Object> mapRow(ResultSet rs, int rowNum) throws SQLException {