Comments (4)
参数化有一个优势是天生可防御sql注入。这个问题可能需要一起考虑。
from smartsql.
SmartSql/src/SmartSql/Configuration/Tags/SqlText.cs
Lines 44 to 50 in 5620943
通过集合的第一个元素判断集合元素类型,如果是int,long等数字类型就直接拼接,bool类型转换成0/1再拼接,字符串用'
包围,日期转换成字符串再用'
包含后拼接,应该不会有注入问题
from smartsql.
efcore是判断你是常量还是变量如果是变量那么就是参数化如果是常量才是直接在sql中
from smartsql.
efcore是判断你是常量还是变量如果是变量那么就是参数化如果是常量才是直接在sql中
我这项目里有很多查询都依赖于用户当前有权限的组织,所以组织每次都是通过调接口获取的。然后生成的查询里,组织Id都是直接在SQL里,并没有参数化。
from smartsql.
Related Issues (20)
- 实现mybatis 的 Example HOT 2
- 升级到net5 HOT 7
- Where或者Dynamic没有任何命中时,会产生不合法的语句 HOT 2
- 找不到配置项的异常提示有点迷 HOT 5
- where条件里In查询是怎么写的 HOT 1
- select * 报错,改为select id,name.... 全部列名就没事 HOT 2
- 升级版本后ISmartSqlMapper,SmartSql.Abstractions找不到
- 建议将DbProvider的配置放到配置文件中 HOT 12
- for
- 哪里有smartsql的学习网站,感觉官网写的太笼统了,而且用的人也不是很多 HOT 4
- Oracle 中的union all 语句 smartsql不支持,请帮忙看下。 HOT 4
- IList<string> List<T> 类似的泛型在反序列化时报错
- SmartSql目前是否还在维护?
- The unit test project (SmartSql.Test.Unit) uses MySql as the database for easy integration testing. HOT 1
- Dependency Dashboard
- 最近一次修改SqlText.cs中的正则表达式,会导致有些情况下匹配错误
- Settings.ParameterPrefix is not affected in method using StatementAttribute HOT 2
- Oracle存储过程,返回参数没有游标
- Parameter新增DbType属性,直接指定数据库字段类型,无需配置TypeHandler
Recommend Projects
-
React
A declarative, efficient, and flexible JavaScript library for building user interfaces.
-
Vue.js
🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
-
Typescript
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
-
TensorFlow
An Open Source Machine Learning Framework for Everyone
-
Django
The Web framework for perfectionists with deadlines.
-
Laravel
A PHP framework for web artisans
-
D3
Bring data to life with SVG, Canvas and HTML. 📊📈🎉
-
Recommend Topics
-
javascript
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
-
web
Some thing interesting about web. New door for the world.
-
server
A server is a program made to process requests and deliver data to clients.
-
Machine learning
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
-
Visualization
Some thing interesting about visualization, use data art
-
Game
Some thing interesting about game, make everyone happy.
Recommend Org
-
Facebook
We are working to build community through open source technology. NB: members must have two-factor auth.
-
Microsoft
Open source projects and samples from Microsoft.
-
Google
Google ❤️ Open Source for everyone.
-
Alibaba
Alibaba Open Source for everyone
-
D3
Data-Driven Documents codes.
-
Tencent
China tencent open source team.
from smartsql.