TRKJ/mayfly-go
2
0
Fork 0
mirror of https://gitee.com/dromara/mayfly-go synced 2025-12-28 18:36:34 +08:00
Code Issues Packages Projects Releases Wiki Activity

fix: sql字符串拼接改为占位符形式，防sql注入

Browse Source
This commit is contained in:
meilin.huang
2022-10-31 18:39:52 +08:00
committed by 刘宗洋
parent f936331dff
commit 74e5ee41fb
7 changed files with 39 additions and 20 deletions
Download Patch File Download Diff File Expand all files Collapse all files

10
server/internal/redis/infrastructure/persistence/redis_repo.go
View File

@@ -19,18 +19,20 @@ func newRedisRepo() repository.Redis {
// 分页获取机器信息列表
func (r *redisRepoImpl) GetRedisList(condition *entity.RedisQuery, pageParam *model.PageParam, toEntity interface{}, orderBy ...string) *model.PageResult {
sql := "SELECT d.* FROM t_redis d WHERE 1=1 "
values := make([]interface{}, 0)
if condition.Host != "" {
sql = sql + " AND d.host LIKE '%" + condition.Host + "%'"
sql = sql + " AND d.host LIKE ?"
values = append(values, "%"+condition.Host+"%")
}
if len(condition.TagIds) > 0 {
sql = sql + " AND d.tag_id IN " + fmt.Sprintf("(%s)", strings.Join(utils.NumberArr2StrArr(condition.TagIds), ","))
}
if condition.TagPathLike != "" {
sql = sql + " AND d.tag_path LIKE '" + condition.TagPathLike + "%'"
sql = sql + " AND d.tag_path LIKE ?"
values = append(values, condition.TagPathLike+"%")
}
sql = sql + " ORDER BY d.tag_path"
return model.GetPageBySql(sql, pageParam, toEntity)
return model.GetPageBySql(sql, pageParam, toEntity, values...)
}
func (r *redisRepoImpl) Count(condition *entity.RedisQuery) int64 {