how to remove the ' ' when the dynamic argument is String type?

user_9782912 0
Viewed 204

I want to use jpa @Query and found out that the argument of type String will be enclosed in single quotes ('') in the sql statement automatically. Since it is a subquery, it will cause an SQL error:

@Query(value="select cate_id,dt,channel,game_id,new_income_money,new_account,consume from ? " +
        " where cate_id=? and dt between ? and ?" ,nativeQuery = true)
List<TfData> findTfRangeData(String subsql, Integer cate_id, String start_dt, String end_dt);

What can I do to prevent this behaviour?

spring-data-jpa java
2 Answers

This is a feature, designed to prevent SQL injection attacks - rather than concatenating raw text that could be exploited by an attacker, it uses a parameterised query to add the parameter in a safe way.

Unfortunately for you, you're actually trying to use SQL injection to achieve what you want. You should look at changing that, and instead of building a String containing a dynamic query, use some flavour of DSL library.

Spring-Data-JPA supports a few ways to do this, including Criteria, Specifications and QueryDSL.

This post has a quick overview of how to use them.

user_63479810

I have tried two ways to solve my problem. First,use JDBC. Second,integrate mybatis framework.Add the dependency to pom.xml and write a mapper to realize my needs.It is quite simple for springboot project. use JDBC dependency and mapper the mapper

user_97829120
Related