参数名引发的血案

亦凉 2022-08-21 11:53 307阅读 0赞

概况

今天在解决一个Bug时，修改了原先的SQL语句，在数据库执行通过之后，复制到了项目中，使用MyBatis进行查询，却屡屡报错，现在把解决问题的过程记下来

报错信息

报错1

  1. 2016/04/29 13:51:20 ERROR ExamResultServiceImpl:50 - 查询视力检查结果异常
  2. org.springframework.jdbc.UncategorizedSQLException: 
  3. ### Error querying database. Cause: java.sql.SQLException: sql injection violation, syntax error: syntax error, expect CALL, actual FROM : SELECT
  4.         a.screen_type,
  5.         a.file_id,
  6.         vis.vaexamtime as done_date,
  7.         c.hospital_name
  8.     FROM
  9.         eye_refraction_info a,
  10.         eye_x_hospital_info c,
  11.         eye_diab_visualacuity vis
  12.     WHERE
  13.         a.hospital_id = c.hospital_id
  14.     AND a.exam_id = vis.examoid
  15.     AND a.personcard_no = ?
  16.     AND a.del_flag = '0'
  17.     AND vis.del_flag = '0'
  18.     AND c.del_flag = '0'
  19.     AND a.file_status > 3
  20.     ORDER BY
  21.         done_date DESC
  22.     LIMIT $ {from}, $ {pagesize}

报错2：

  1. 2016/04/29 14:19:03 ERROR ExamResultServiceImpl:50 - 查询视力检查结果异常
  2. org.springframework.jdbc.BadSqlGrammarException: 
  3. ### Error querying database. Cause: com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'null' at line 20
  4. ### The error may exist in file [***.xml]
  5. ### The error may involve ***.getAllExamResults-Inline
  6. ### The error occurred while setting parameters
  7. ### SQL: SELECT a.screen_type, a.file_id, vis.vaexamtime as done_date, c.hospital_name FROM eye_refraction_info a, eye_x_hospital_info c, eye_diab_visualacuity vis WHERE a.hospital_id = c.hospital_id AND a.exam_id = vis.examoid AND a.personcard_no = ? AND a.del_flag = '0' AND vis.del_flag = '0' AND c.del_flag = '0' AND a.file_status > 3 ORDER BY done_date DESC LIMIT ?, ?
  8. ### Cause: com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'null' at line 20
  9. ; bad SQL grammar []; nested exception is com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near 'null' at line 20
  10.     at org.springframework.jdbc.support.SQLErrorCodeSQLExceptionTranslator.doTranslate(SQLErrorCodeSQLExceptionTranslator.java:231)
  11.     at org.springframework.jdbc.support.AbstractFallbackSQLExceptionTranslator.translate(AbstractFallbackSQLExceptionTranslator.java:73)
  12.     at org.mybatis.spring.MyBatisExceptionTranslator.translateExceptionIfPossible(MyBatisExceptionTranslator.java:73)
  13.     at org.mybatis.spring.SqlSessionTemplate$SqlSessionInterceptor.invoke(SqlSessionTemplate.java:371)
  14.     at com.sun.proxy.$Proxy20.selectList(Unknown Source)
  15.     at org.mybatis.spring.SqlSessionTemplate.selectList(SqlSessionTemplate.java:198)
  16.     at org.apache.ibatis.binding.MapperMethod.executeForMany(MapperMethod.java:114)
  17.     at org.apache.ibatis.binding.MapperMethod.execute(MapperMethod.java:58)
  18.     at org.apache.ibatis.binding.MapperProxy.invoke(MapperProxy.java:43)
  19.     at com.sun.proxy.$Proxy21.getAllExamResults(Unknown Source)
  20.     at **.getExamResult(**.java:37)
  21.     at ** (**.java:64)
  22.     at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
  23.     at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.java:57)
  24.     at sun.reflect.DelegatingMethodAccessorImpl.invoke(DelegatingMethodAccessorImpl.java:43)
  25.     at java.lang.reflect.Method.invoke(Method.java:606)
  26.     at org.springframework.web.method.support.InvocableHandlerMethod.invoke(InvocableHandlerMethod.java:215)
  27.     at org.springframework.web.method.support.InvocableHandlerMethod.invokeForRequest(InvocableHandlerMethod.java:132)
  28.     at org.springframework.web.servlet.mvc.method.annotation.ServletInvocableHandlerMethod.invokeAndHandle(ServletInvocableHandlerMethod.java:104)
  29.     at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.invokeHandleMethod(RequestMappingHandlerAdapter.java:749)
  30.     at org.springframework.web.servlet.mvc.method.annotation.RequestMappingHandlerAdapter.handleInternal(RequestMappingHandlerAdapter.java:690)
  31.     at org.springframework.web.servlet.mvc.method.AbstractHandlerMethodAdapter.handle(AbstractHandlerMethodAdapter.java:83)
  32.     at org.springframework.web.servlet.DispatcherServlet.doDispatch(DispatcherServlet.java:945)
  33.     at org.springframework.web.servlet.DispatcherServlet.doService(DispatcherServlet.java:876)
  34.     at org.springframework.web.servlet.FrameworkServlet.processRequest(FrameworkServlet.java:961)
  35.     at org.springframework.web.servlet.FrameworkServlet.doGet(FrameworkServlet.java:852)
  36.     at javax.servlet.http.HttpServlet.service(HttpServlet.java:622)
  37.     at org.springframework.web.servlet.FrameworkServlet.service(FrameworkServlet.java:837)
  38.     at javax.servlet.http.HttpServlet.service(HttpServlet.java:729)
  39.     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:292)
  40.     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207)
  41.     at org.apache.tomcat.websocket.server.WsFilter.doFilter(WsFilter.java:52)
  42.     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240)
  43.     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207)
  44.     at org.springframework.web.filter.CharacterEncodingFilter.doFilterInternal(CharacterEncodingFilter.java:88)
  45.     at org.springframework.web.filter.OncePerRequestFilter.doFilter(OncePerRequestFilter.java:108)
  46.     at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(ApplicationFilterChain.java:240)
  47.     at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationFilterChain.java:207)
  48.     at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperValve.java:212)
  49.     at org.apache.catalina.core.StandardContextValve.invoke(StandardContextValve.java:106)
  50.     at org.apache.catalina.authenticator.AuthenticatorBase.invoke(AuthenticatorBase.java:502)
  51.     at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.java:141)
  52.     at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.java:79)
  53.     at org.apache.catalina.valves.AbstractAccessLogValve.invoke(AbstractAccessLogValve.java:616)
  54.     at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineValve.java:88)
  55.     at org.apache.catalina.connector.CoyoteAdapter.service(CoyoteAdapter.java:522)
  56.     at org.apache.coyote.http11.AbstractHttp11Processor.process(AbstractHttp11Processor.java:1095)
  57.     at org.apache.coyote.AbstractProtocol$AbstractConnectionHandler.process(AbstractProtocol.java:672)
  58.     at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.doRun(NioEndpoint.java:1500)
  59.     at org.apache.tomcat.util.net.NioEndpoint$SocketProcessor.run(NioEndpoint.java:1456)
  60.     at java.util.concurrent.ThreadPoolExecutor.runWorker(ThreadPoolExecutor.java:1145)
  61.     at java.util.concurrent.ThreadPoolExecutor$Worker.run(ThreadPoolExecutor.java:615)
  62.     at org.apache.tomcat.util.threads.TaskThread$WrappingRunnable.run(TaskThread.java:61)
  63.     at java.lang.Thread.run(Thread.java:745)

原因

之前用的分页是这样的：

  1. LIMIT ${from}, ${pagesize}

其中，开始位置的参数同事用了“from”，和数据库中的关键字一样有木有！！现在的语句是这样的：

  1. SELECT
  2.         a.screen_type,
  3.         a.file_id,
  4.         vis.vaexamtime as done_date,
  5.         c.hospital_name
  6.     FROM eye_refraction_info a, eye_x_hospital_info c, eye_diab_visualacuity vis
  7.     WHERE
  8.         a.hospital_id = c.hospital_id
  9.     AND a.exam_id = vis.examoid
  10.     AND a.personcard_no = #{personcard}
  11.     AND a.del_flag = '0'
  12.     AND vis.del_flag = '0'
  13.     AND c.del_flag = '0'
  14.     AND a.file_status > 3
  15.     ORDER BY done_date DESC LIMIT #{pageStart}, #{pageSize}

后来根据报错信息，发现其中一个参数为Null，检查参数名称后发现，原来传入的是“pagesize”，mybatis中配置的是“pageSize”，一个字母大小写，折腾了这么久，太不应该了。

教训

  1. 以报错信息为准去找问题，不要乱找
  2. 遇事冷静、细心分析

发表评论

表情：
评论列表 （有 0 条评论，307人围观）

还没有评论，来说两句吧...

相关阅读

    相关 参数名引发的血案

    概况 今天在解决一个Bug时，修改了原先的SQL语句，在数据库执行通过之后，复制到了项目中，使用MyBatis进行查询，却屡屡报错，现在把解决问题的过程记下来 报错信

    亦凉亦凉/ 0 赞/ 308 阅读

    相关 一个“-”引发的血案

    也许你永远遇不到这样的bug的，但是你要知道什么bug都有，所以不要惊讶！ 简化场景： 拼接了这样一个字符串：1.2,2.3,0.4-flag（三个double值用逗

    清疚清疚/ 0 赞/ 379 阅读

    相关 一个Sqrt函数引发的血案

    好吧，我承认我标题党了，不过既然你来了，就认真看下去吧，保证你有收获。 　　我们平时经常会有一些数据运算的操作，需要调用sqrt，exp，abs等函数，那么时候你有没有想过：

    叁歲伎倆叁歲伎倆/ 0 赞/ 435 阅读