如何遵守Sonar的规则"SQL binding mechanisms should be used"

Question

如何更改以下查询以符合 SQL Injection 规则

select * from table where modified_on < now()- INTERVAL '" + interval + " seconds'

我无法在 Java

中更改准备准备语句的查询

 select * from table where modified_on < now()- INTERVAL ? seconds

Answer 1

你可以将秒数作为参数传递并乘以1秒的间隔

select * 
from table 
where modified_on < now() - (? * INTERVAL '1 second')

How to comply with Sonar's rule "SQL binding mechanisms should be used"