【问题标题】:I just need to escape single quote in DECODE Function in oracle, need help on this?我只需要在 oracle 的 DECODE 函数中转义单引号,需要帮助吗?
【发布时间】:2021-08-15 16:51:42
【问题描述】:

这是我的代码:当我使用单引号对字段 namegender 进行测试时,出现以下异常:

}
    sql = "SELECT * FROM dummy.employee_details " + "WHERE name = decode('" + name + "','',name,'" + name
                    + "') AND " + "fname = decode('" + fname + "','',fname,'" + fname + "') AND " + "gender = decode('"
                    + gender + "','',gender,'" + gender + "') AND " + "Age = decode(" + Age + ",null,Age," + Age
                    + ") AND " + "startDate = decode(to_date('" + query_date
                    + "','yyyy-mm-dd'),'null',startDate,to_date('" + query_date + "','yyyy-mm-dd')) AND "
                    + "salary = decode(" + salary + ",null,salary," + salary + ")";
} else {
    sql = "SELECT * FROM dummy.employee_details " + "WHERE name = decode('" + name + "','',name,'" + name
                    + "') AND " + "fname = decode('" + fname + "','',fname,'" + fname + "') AND " + "gender = decode('"
                    + gender + "','',gender,'" + gender + "') AND " + "Age = decode(" + Age + ",null,Age," + Age
                    + ") AND " + "salary = decode(" + salary + ",null,salary," + salary + ")";
}

例外

java.sql.SQLSyntaxErrorException: ORA-00938: not enough arguments for function

    at oracle.jdbc.driver.T4CTTIoer11.processError(T4CTTIoer11.java:494)
    at oracle.jdbc.driver.T4CTTIoer11.processError(T4CTTIoer11.java:446)
    at oracle.jdbc.driver.T4C8Oall.processError(T4C8Oall.java:1054)
    at oracle.jdbc.driver.T4CTTIfun.receive(T4CTTIfun.java:623)
    at oracle.jdbc.driver.T4CTTIfun.doRPC(T4CTTIfun.java:252)
    at oracle.jdbc.driver.T4C8Oall.doOALL(T4C8Oall.java:612)
    at oracle.jdbc.driver.T4CPreparedStatement.doOall8(T4CPreparedStatement.java:226)
    at oracle.jdbc.driver.T4CPreparedStatement.doOall8(T4CPreparedStatement.java:59)
    at oracle.jdbc.driver.T4CPreparedStatement.executeForDescribe(T4CPreparedStatement.java:747)
    at oracle.jdbc.driver.OracleStatement.executeMaybeDescribe(OracleStatement.java:904)
    at oracle.jdbc.driver.OracleStatement.doExecuteWithTimeout(OracleStatement.java:1082)
    at oracle.jdbc.driver.OraclePreparedStatement.executeInternal(OraclePreparedStatement.java:3780)
    at oracle.jdbc.driver.T4CPreparedStatement.executeInternal(T4CPreparedStatement.java:1343)
    at oracle.jdbc.driver.OraclePreparedStatement.executeQuery(OraclePreparedStatement.java:3822)
    at oracle.jdbc.driver.OraclePreparedStatementWrapper.executeQuery(OraclePreparedStatementWrapper.java:1165)
    at com.fadel.model.dao.impl.EmployeeDAOImpl.advanceSearch(EmployeeDAOImpl.java:177)
    at com.fadel.model.bo.Impl.EmployeeBOImpl.advanceSearch(EmployeeBOImpl.java:47)
    at com.fadel.model.view.backing.EmployeeController.listEmployees(EmployeeController.java:151)
    at com.fadel.model.view.backing.EmployeeController.getEmployees(EmployeeController.java:129)
    at sun.reflect.GeneratedMethodAccessor483.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at javax.el.BeanELResolver.getValue(BeanELResolver.java:88)
    at com.sun.faces.el.DemuxCompositeELResolver._getValue(Unknown Source)
    at com.sun.faces.el.DemuxCompositeELResolver.getValue(Unknown Source)
    at org.apache.el.parser.AstValue.getValue(AstValue.java:169)
    at org.apache.el.ValueExpressionImpl.getValue(ValueExpressionImpl.java:190)
    at com.sun.faces.facelets.el.TagValueExpression.getValue(Unknown Source)
    at javax.faces.component.ComponentStateHelper.eval(ComponentStateHelper.java:194)
    at javax.faces.component.ComponentStateHelper.eval(ComponentStateHelper.java:182)
    at org.richfaces.component.UISequence.getValue(UISequence.java:180)
    at org.richfaces.component.UISequence.createExtendedDataModel(UISequence.java:114)
    at org.richfaces.component.UIDataTableBase.createExtendedDataModel(UIDataTableBase.java:194)
    at org.richfaces.component.UIDataAdaptor.getExtendedDataModel(UIDataAdaptor.java:467)
    at org.richfaces.component.UIDataAdaptor.getRowCount(UIDataAdaptor.java:518)
    at sun.reflect.GeneratedMethodAccessor414.invoke(Unknown Source)
    at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
    at java.lang.reflect.Method.invoke(Method.java:498)
    at javax.faces.component.UIComponentBase$AttributesMap.get(UIComponentBase.java:2387)
    at org.richfaces.DataScrollerUtils.eval(DataScrollerUtils.java:86)
    at org.richfaces.DataScrollerUtils.getRowCount(DataScrollerUtils.java:81)
    at org.richfaces.event.DataTablePreRenderListener.processEvent(DataTablePreRenderListener.java:124)
    at javax.faces.event.SystemEvent.processListener(SystemEvent.java:108)
    at javax.faces.event.ComponentSystemEvent.processListener(ComponentSystemEvent.java:118)
    at com.sun.faces.application.ApplicationImpl.processListeners(Unknown Source)
    at com.sun.faces.application.ApplicationImpl.invokeListenersFor(Unknown Source)
    at com.sun.faces.application.ApplicationImpl.publishEvent(Unknown Source)
    at com.sun.faces.application.ApplicationImpl.publishEvent(Unknown Source)
    at javax.faces.component.UIComponentBase.encodeBegin(UIComponentBase.java:856)
    at com.sun.faces.renderkit.html_basic.HtmlBasicRenderer.encodeRecursive(Unknown Source)
    at com.sun.faces.renderkit.html_basic.GroupRenderer.encodeChildren(Unknown Source)
    at javax.faces.component.UIComponentBase.encodeChildren(UIComponentBase.java:889)
    at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1857)
    at com.sun.faces.context.PartialViewContextImpl$PhaseAwareVisitCallback.visit(Unknown Source)
    at org.richfaces.context.MetaComponentEncodingVisitCallback.visit(MetaComponentEncodingVisitCallback.java:83)
    at org.richfaces.context.BaseExtendedVisitContext.invokeVisitCallback(BaseExtendedVisitContext.java:103)
    at org.richfaces.context.ExtendedRenderVisitContext.invokeVisitCallback(ExtendedRenderVisitContext.java:65)
    at javax.faces.component.UIComponent.visitTree(UIComponent.java:1690)
    at javax.faces.component.UIComponent.visitTree(UIComponent.java:1701)
    at javax.faces.component.UIComponent.visitTree(UIComponent.java:1701)
    at javax.faces.component.UIForm.visitTree(UIForm.java:371)
    at javax.faces.component.UIComponent.visitTree(UIComponent.java:1701)
    at javax.faces.component.UIComponent.visitTree(UIComponent.java:1701)
    at com.sun.faces.context.PartialViewContextImpl.processComponents(Unknown Source)
    at com.sun.faces.context.PartialViewContextImpl.processPartial(Unknown Source)
    at org.richfaces.context.ExtendedPartialViewContext.processPartial(ExtendedPartialViewContext.java:264)
    at javax.faces.component.UIViewRoot.encodeChildren(UIViewRoot.java:1004)
    at javax.faces.component.UIComponent.encodeAll(UIComponent.java:1857)
    at com.sun.faces.application.view.FaceletViewHandlingStrategy.renderView(Unknown Source)
    at com.sun.faces.application.view.MultiViewHandler.renderView(Unknown Source)
    at javax.faces.application.ViewHandlerWrapper.renderView(ViewHandlerWrapper.java:337)
    at com.sun.faces.lifecycle.RenderResponsePhase.execute(Unknown Source)
    at com.sun.faces.lifecycle.Phase.doPhase(Unknown Source)
    at com.sun.faces.lifecycle.LifecycleImpl.render(Unknown Source)
    at javax.faces.webapp.FacesServlet.service(FacesServlet.java:647)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:227)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:53)
    at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:189)
    at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:162)
    at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:202)
    at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:97)
    at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:542)
    at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:143)
    at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:92)
    at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:687)
    at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:78)
    at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:346)
    at org.apache.coyote.http11.Http11Processor.service(Http11Processor.java:374)
    at org.apache.coyote.AbstractProcessorLight.process(AbstractProcessorLight.java:65)
    at org.apache.coyote.AbstractProtocol$ConnectionHandler.process(AbstractProtocol.java:887)
    at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1684)
    at org.apache.tomcat.util.net.SocketProcessorBase.run(SocketProcessorBase.java:49)
    at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1149)
    at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:624)
    at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
    at java.lang.Thread.run(Thread.java:748)
Caused by: Error : 938, Position : 120, Sql = SELECT * FROM dummy.employee_details WHERE name = decode('','',name,'') AND fname = decode('','',fname,'') AND gender = decode(''','',gender,''') AND Age = decode(null,null,Age,null) AND salary = decode(null,null,salary,null), OriginalSql = SELECT * FROM dummy.employee_details WHERE name = decode('','',name,'') AND fname = decode('','',fname,'') AND gender = decode(''','',gender,''') AND Age = decode(null,null,Age,null) AND salary = decode(null,null,salary,null), Error Msg = ORA-00938: not enough arguments for function

    at oracle.jdbc.driver.T4CTTIoer11.processError(T4CTTIoer11.java:498)
    ... 96 more

【问题讨论】:

  • 使用参数化查询
  • 不要连接字符串。改为使用? 应用参数,您永远不需要处理转义字符串。
  • 绑定你的变量。绑定你的变量!说真的,当你可以绑定你的变量时,为什么要将你的代码暴露给 SQL 注入......正如已经建议的那样?此外,数据库会感谢您,因为每次您传入新值时,它都不必对查询进行硬解析。不要连接您的值;绑定他们。

标签: java sql oracle jdbc plsql


【解决方案1】:

检查这里:

从对偶中选择“kober's guy”作为名称;--print kober's guy

你可以在你的代码中使用一个简单的替换

name = name.replace("'","''");

【讨论】:

    猜你喜欢
    • 1970-01-01
    • 2017-02-09
    • 2022-01-04
    • 2021-04-29
    • 2013-04-23
    • 2015-02-17
    • 1970-01-01
    • 2016-02-11
    • 1970-01-01
    相关资源
    最近更新 更多