![](https://iknow-base.cdn.bcebos.com/lxb/notice.png)
关于预编译SQL语句 帮忙看一下对不对啊
Stringsql="updateT_M_ZAIKOUsetOUT_DATE=to_date('?','yyyy-mm-ddhh24:mi:ss'),"+"TENKI_C...
String sql = "update T_M_ZAIKOU set OUT_DATE = to_date('?','yyyy-mm-dd hh24:mi:ss'),"
+ "TENKI_CD = ?,SHARYOU_CD = ?,OUT_METER = ?,"
+ "IN_DATE = to_date('?','yyyy-mm-dd hh24:mi:ss'),IN_METER = ? where SYSTEM_ID = ?";
pst = conn.prepareStatement(sql);
pst.setString(1, updateStockBean.getOut_date()+" "+updateStockBean.getOut_time());
pst.setString(2, updateStockBean.getTenki_cd());
pst.setString(3, updateStockBean.getSharyou_cd());
pst.setString(4, updateStockBean.getOut_neter());
pst.setString(5, updateStockBean.getIn_date()+" "+updateStockBean.getIn_time());
pst.setString(6, updateStockBean.getIn_neter());
pst.setLong(7, updateStockBean.getSystem_id());
int row = pst.executeUpdate(); 展开
+ "TENKI_CD = ?,SHARYOU_CD = ?,OUT_METER = ?,"
+ "IN_DATE = to_date('?','yyyy-mm-dd hh24:mi:ss'),IN_METER = ? where SYSTEM_ID = ?";
pst = conn.prepareStatement(sql);
pst.setString(1, updateStockBean.getOut_date()+" "+updateStockBean.getOut_time());
pst.setString(2, updateStockBean.getTenki_cd());
pst.setString(3, updateStockBean.getSharyou_cd());
pst.setString(4, updateStockBean.getOut_neter());
pst.setString(5, updateStockBean.getIn_date()+" "+updateStockBean.getIn_time());
pst.setString(6, updateStockBean.getIn_neter());
pst.setLong(7, updateStockBean.getSystem_id());
int row = pst.executeUpdate(); 展开
展开全部
sql注入怎么回事:说白了就是在一个单引号上做文章,你把单引号转义就没啥问题了,预编译就是把这些字符转义后插入,其中包括单引号。
这段可以防止.
这段可以防止.
追问
就是说不能把问号放在单引号内吗,怎么改才好?
推荐律师服务:
若未解决您的问题,请您详细描述您的问题,通过百度律临进行免费专业咨询