参数化查询ORM与在条款

Question

我想参数化是目前正在和已经成熟的SQL注入攻击的查询：

qryAwards = ORMExecuteQuery(
    "from Award where awardID in (#form.deleteAwardList#) and Game.Season.User.userID=:uid", 
    {uid=session.userID} 
); 
if(not isNull(qryAwards) and arrayLen(qryAwards)){ 
    for(i in qryAwards){ 
     entityDelete(i); 
    } 
} 

我想这一点，有没有单引号帕拉姆：

qryAwards = ORMExecuteQuery(
    "from Award where awardID in (:awardList) and Game.Season.User.userID=:uid", 
    {awardList=form.deleteAwardList, uid=session.userID} 
); 

我不断收到以下错误：

The value 117,118 cannot be converted to a number.

而这一点，用单引号括起来帕拉姆：

qryAwards = ORMExecuteQuery(
    "from Award where awardID in (':awardList') and Game.Season.User.userID=:uid", 
    {awardList=form.deleteAwardList, uid=session.userID} 
); 

获取我下面的错误：

Invalid parameters specified for the query.

Answer 1

在HQL（这是当你做ORMExecuteQuery()你用什么）使用的参数在IN子句中需要作为数组传递。您需要将form.deleteAwardList转换为数组。有几种不同的方式来处理这个问题，但这会起作用。

qryAwards = ORMExecuteQuery(
    "from Award where awardID in (:awardList) and Game.Season.User.userID=:uid", 
    {awardList=listToArray(form.deleteAwardList), uid=session.userID} 
);