druid 普通的查询语句涉及到SQL注入的问题

Question

添加WallFilter后，运行报SQL注入。

报错的代码如下：

public List<CourseResearch> findByCourseCode(String courseCode){
    String sqlClause = "SELECT * FROM courseresearch WHERE researchcoursecode=?";
    return CourseResearch.dao.find(sqlClause, courseCode);
}

运行起来报错如下：

java.sql.SQLException: sql injection violation :  SELECT * FROM courseresearch WHERE　researchcoursecode=?
......
......

com.alibaba.druid.sql.parser.ParserException: TODO : EQ WHERE researchcoursecode

.....

一句简单的SQL怎么就会出现SQL注入呢，请大神们给解决下，谢谢！

 

Answer 1

形式是这样的   Insert into Table2(field1,field2,...) select value1,value2,... from Table1

Answer 2

中文问号？

Answer 3

回复
这我就不清楚了，请仔细参照Druid关于防止注入的说明

Answer 4

为什么没用系统函数sys_guid()，就不会出现SQL注入呢？

Answer 5

谢谢你们耐心的回答。。。好的，请问下有关于Druid防注入的参考资料或链接吗？请提供一份谢谢

Answer 6

回复
https://github.com/alibaba/druid/wiki/%E9%85%8D%E7%BD%AE-wallfilter

Answer 7

引用来自“vitoshu”的评论

再次遇到这样的问题

insert into BudgetControl value
  (id, controlyear, controlorgid, controllock, create_op, budgetattribute)
  select /*+ connect_by_filtering */
   sys_guid() as id,
   2015 as controlyear,
   id as controlorgid,
   1 as controllock,
   '097361' as create_op,
   1 as budgetattribute
    from org
   where orgisdeleted = '89'
   START WITH orgprntorgfk = '0100000000'
           or id = '0100000000'
  CONNECT BY PRIOR id = orgprntorgfk

这段SQL代码也报SQL注入，请帮我检查下，谢谢

Answer 8

找到问题了，不可以带系统函数sys_guid().

Answer 9

再次遇到这样的问题

insert into BudgetControl value
  (id, controlyear, controlorgid, controllock, create_op, budgetattribute)
  select /*+ connect_by_filtering */
   sys_guid() as id,
   2015 as controlyear,
   id as controlorgid,
   1 as controllock,
   '097361' as create_op,
   1 as budgetattribute
    from org
   where orgisdeleted = '89'
   START WITH orgprntorgfk = '0100000000'
           or id = '0100000000'
  CONNECT BY PRIOR id = orgprntorgfk

这段SQL代码也报SQL注入，请帮我检查下，谢谢

Answer 10

courseresearch WHERE这两个字符中间是不是用了中文全角空格？

Answer 11

换过了，还是依然报那错

Answer 12

那个问号 貌似不大对 你多换一个

Answer 13

请问下，EQ WHERE 这是什么解析异常，我查看您的WallFilter源代码，没找到具体描述性语句

Answer 14

中文问号？