<?xml version="1.0" encoding="UTF-8"?>

<!DOCTYPE mapper

PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"

"http://mybatis.org/dtd/mybatis-3-mapper.dtd">

<mapper namespace="top.whgojp.modules.sqli.mapper.SqliMapper">

<resultMap id="BaseResultMap" type="top.whgojp.modules.sqli.entity.Sqli">

<id property="id" column="id" jdbcType="INTEGER"/>

<result property="username" column="username" jdbcType="VARCHAR"/>

<result property="password" column="password" jdbcType="VARCHAR"/>

</resultMap>

<sql id="Base_Column_List">

id,username,password

</sql>

<!-- 自定义mapper增删改查方法

<insert id="customInsert">

insert into sqli (id,username,password) values (#{id,jdbcType=INTEGER},#{username,jdbcType=VARCHAR},#{password,jdbcType=VARCHAR})

</insert>

<delete id="customDelete">

delete from sqli where id = #{id,jdbcType=INTEGER}

</delete>

<select id="orderByVul" resultType="top.whgojp.modules.sqli.entity.Sqli">

SELECT * FROM sqli

<if test="field != null and field != ''">

ORDER BY ${field}

</if>

</select>

<select id="orderByPrepareStatement" resultType="top.whgojp.modules.sqli.entity.Sqli">

SELECT * FROM sqli

<if test="field != null and field != ''">

ORDER BY #{field}

</if>

</select>

<select id="orderByWriteList" resultType="top.whgojp.modules.sqli.entity.Sqli">

SELECT * FROM sqli

<if test="field != null and field != ''">

<choose>

<!-- 排序列名白名单 -->

<when test="field == 'id' or field == 'username' or field == 'password'">

ORDER BY ${field}

</when>

<otherwise>

<!-- 默认使用id进行排序 -->

ORDER BY id

</otherwise>

</choose>

</if>

</select>

<select id="likeVul" resultType="top.whgojp.modules.sqli.entity.Sqli">

SELECT * FROM sqli WHERE username LIKE '%${keyword}%'

</select>

<select id="likePrepareStatement" resultType="top.whgojp.modules.sqli.entity.Sqli">

SELECT * FROM sqli WHERE username LIKE CONCAT('%', #{keyword}, '%')

</select>

<select id="inVul" resultType="top.whgojp.modules.sqli.entity.Sqli">

select * from sqli where id in (${id})

</select>

<select id="inPrepareStatement" resultType="top.whgojp.modules.sqli.entity.Sqli">

select * from sqli where id in (#{id})

</select>

<select id="inSafeForeach" resultType="top.whgojp.modules.sqli.entity.Sqli">

SELECT * FROM sqli WHERE id IN

<foreach collection="scope" item="id" open="(" separator="," close=")">

#{id}

</foreach>

</select>

</mapper>