java - java.sql.SQLException：sql注入违规，评论不允许：选择

Question

正如标题所说，我使用SQL选择但报告错误。下面Mapper中的SQL

<select id="selectBillDetailByBizIdAndClearType" resultMap="BaseResultMap">
    select
    <include refid="Base_Column_List" />
    from dwd_clearing_bill_detail
    where biz_detail_id in
    <foreach collection="bizDetailIdList" item="item" index="index" open="(" separator="," close=")">
      #{item}
    </foreach>
    and clear_type in
    <foreach collection="clearTypeList" item="item" index="index" open="(" separator="," close=")">
      #{item}
    </foreach>
  </select>

Answer 1

这是一个例外，表明以这种方式构建 SQL 语句是不安全的。有人可以注入恶意 SQL 代码、检索敏感数据或修改/删除您的数据。请参阅https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html