Javaプリペアドステートメントで異なる値を持つSQL選択要求

Question

こんにちは！

私はJSP、mvc、およびJAVAを使用していますが、私のデータベースの情報をmy *で異なる値でselect *で表示しようとしています： "SELECT * FROM customers WHERE lastname = 'AND city ='"

問題は、JUnitでこのリクエストをテストすると、私のWHEREの最初のパラメータの近くにエラーがあることです。

PS：Where句に1つのパラメータを指定して選択要求を行うと、それが動作します。

私のコードは以下の通りです。

要求と私のクラス：

public class CustomerDao extends DAO<Customer>{ 


private static final String SQL_SELECT_Plus = "SELECT * FROM customers WHERE lastname =' AND city ='"; 



public CustomerDao(Connection c) { 
     super(c); 
    } 

@Override 
    public List<Customer> findByPlus(String lastname, String city) throws DAOException { 
     Connection connection = null; 
     PreparedStatement preparedStatement = null; 
     ResultSet resultSet = null; 
     ArrayList<Customer> customers = new ArrayList<Customer>(); 
     System.out.println("test1"); 
     try { 
      System.out.println("test2"); 

      /* Récupération d'une connexion depuis la Factory */ 

      System.out.println("test32"); 
      preparedStatement = this.initRequest(this.connection, SQL_SELECT_Plus + lastname + "'" + city + "'", false); 
      System.out.println("test3"); 

      resultSet = preparedStatement.executeQuery(); 
      System.out.println("test4"); 

      /* Parcours de la ligne de données de l'éventuel ResulSet retourné */ 
      while (resultSet.next()) { 
       customers.add(map(resultSet)); 
       System.out.println("test5"); 

      } 

     } catch (SQLException e) { 
      throw new DAOException(e); 
     } finally { 
      System.out.println("EREUR"); 

      this.silentCloses(resultSet, preparedStatement, connection); 
     } 
     return customers; 
     } 

私のJUnitテスト：

public class AccountControllerTest { 

    CustomerController customerController = new CustomerController(); 


    @Test 
    public void shouldReturnErrorInModel() { 
     customerController.selectAction4("Dupont","Paris"); 

    } 

とJUnitのエラー：

test1 test2 test32 test3 EREUR fr.esipe.ing2.esibank.dao.DAOException: > >org.postgresql.util.PSQLException: ERROR: syntax error at or near > "Dupont" Position : 54 at > >fr.esipe.ing2.esibank.customer.dao.CustomerDao.findByPlus(CustomerDao.java:164) at fr.esipe.ing2.esibank.customer.controller.CustomerController.selectAction4(CustomerController.java:97) at fr.esipe.ing2.esibank.account.AccountControllerTest.shouldReturnErrorInModel(AccountControllerTest.java:15) at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method) at sun.reflect.NativeMethodAccessorImpl.invoke(Unknown Source) at sun.reflect.DelegatingMethodAccessorImpl.invoke(Unknown Source) at java.lang.reflect.Method.invoke(Unknown Source) at org.junit.runners.model.FrameworkMethod$1.runReflectiveCall(FrameworkMethod.java:50) at org.junit.internal.runners.model.ReflectiveCallable.run(ReflectiveCallable.java:12) at org.junit.runners.model.FrameworkMethod.invokeExplosively(FrameworkMethod.java:47) at org.junit.internal.runners.statements.InvokeMethod.evaluate(InvokeMethod.java:17) at org.junit.runners.ParentRunner.runLeaf(ParentRunner.java:325) at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:78) at org.junit.runners.BlockJUnit4ClassRunner.runChild(BlockJUnit4ClassRunner.java:57) at org.junit.runners.ParentRunner$3.run(ParentRunner.java:290) at org.junit.runners.ParentRunner$1.schedule(ParentRunner.java:71) at org.junit.runners.ParentRunner.runChildren(ParentRunner.java:288) at org.junit.runners.ParentRunner.access$000(ParentRunner.java:58) at org.junit.runners.ParentRunner$2.evaluate(ParentRunner.java:268) at org.junit.runners.ParentRunner.run(ParentRunner.java:363) at org.eclipse.jdt.internal.junit4.runner.JUnit4TestReference.run(JUnit4TestReference.java:50) at org.eclipse.jdt.internal.junit.runner.TestExecution.run(TestExecution.java:38) at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:459) at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.runTests(RemoteTestRunner.java:675) at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.run(RemoteTestRunner.java:382) at org.eclipse.jdt.internal.junit.runner.RemoteTestRunner.main(RemoteTestRunner.java:192) Caused by: org.postgresql.util.PSQLException: ERROR: syntax error at or near "Dupont" Position : 54 at org.postgresql.core.v3.QueryExecutorImpl.receiveErrorResponse(QueryExecutorImpl.java:2270) at org.postgresql.core.v3.QueryExecutorImpl.processResults(QueryExecutorImpl.java:1998) at org.postgresql.core.v3.QueryExecutorImpl.execute(QueryExecutorImpl.java:255) at org.postgresql.jdbc2.AbstractJdbc2Statement.execute(AbstractJdbc2Statement.java:570) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeWithFlags(AbstractJdbc2Statement.java:420) at org.postgresql.jdbc2.AbstractJdbc2Statement.executeQuery(AbstractJdbc2Statement.java:305) at fr.esipe.ing2.esibank.customer.dao.CustomerDao.findByPlus(CustomerDao.java:153) ... 25 more

Answer 1

文字列を連結すると、次のSQL文が返されます。 "SELECT * FROM customers WHERE lastname = 'AND city =' Dupont'Paris '"

SQLの文字列連結は決して行うべきではありません。これがSQLインジェクションの仕組みです。

あなたのSQL文字列

String query = "SELECT * FROM customers WHERE lastname=:lastName AND city=:city"; 
NamedParameterStatement ps = new NamedParameterStatement(connection, query); 
ps.setString("lastName", lastname); 
ps.setString("city", city);