2016-08-18 77 views
1

我想创建使用休眠准备语句的新表。它看起来像"setparameter("values", value)"添加额外的引号来查询。 我的代码:休眠setParameter字符串添加单引号

String hql = "create table :values " + "(name VARCHAR(50))"; 
     Query my = session.createSQLQuery(hql); 
     my.setParameter("values", value); 
     my.executeUpdate(); 
     session.close(); 

错误:

SEVERE: Servlet.service() for servlet [contextServlet] in context with path [/SpringSafeHouseService2.0] threw exception [Request processing failed; nested exception is org.hibernate.exception.SQLGrammarException: could not execute statement] with root cause 
com.mysql.jdbc.exceptions.jdbc4.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near ''merkurijuss' (name VARCHAR(50))' at line 1 
+0

您可以使用表名作为参数在事先准备好的声明 – Jens

回答

0

不能在准备好的声明中使用表名称作为参数。你必须把它放进刺:

String hql = "create table "+ value+ " (name VARCHAR(50))"; 
    Query my = session.createSQLQuery(hql); 
    my.executeUpdate(); 
    session.close(); 
+0

那么如何防止SQL注入这个查询? – Liver

+0

@☺LiverSQL注入只适用于列名不为表名 – Jens

+0

的值,但代码是不可读的。 – Jens