人事管理系统6

模糊查询

DepartmentMapper.xml ：

<select id="findDepartmentListByName" resultMap="BaseResultMap">
select
<include refid="Base_Column_List"/>
from department
where dname like '%${dname}%' /*where dname like concat('%',#
{dname},'%')*/
order by establishmentdate desc
limit #{start},#{limit}
</select>
<!--#会把传入的String类型自动加上引号，其他数据类型不会加引号，此处会变成'%'开发部'%'，语法错
误-->
<!--$把传入的数据直接显示在sql语句中，不会添加引号，此处会变成'%开发部%'-->
<select id="getTotalDepartmentsByName" resultType="int">
select count(*) from department where dname like '%${dname}%'
</select>

${} ：不安全

直接拼接 SQL ，容易被 SQL 注入攻击利用。

select * from user where username = '${username}'

若用户输入 admin' or '1'='1 会直接执行

select * from user where username='admin' or '1'='1'

${} 是拼接符

#{} ：安全

通过预编译方式传参，防止 SQL 注入

select * from user where username = #{username}

#{} 是占位符

DepartmentMapper.java ：

List<Department> findDepartmentListByName(@Param("dname") String
dname,@Param("start") int start,@Param("limit") int limit);
int getTotalDepartmentsByName(@Param("dname") String dname);

DepartmentService.java ：

Result getDepartmentsListByName(String dname, int start, int limit);

DepartmentServiceImpl.java ：

@Override
public Result getDepartmentsListByName(String dname, int start, int limit) {
List<Department> departmentList =
departmentMapper.findDepartmentListByName(dname, start, limit);
int totalDepartments = departmentMapper.getTotalDepartmentsByName(dname);
Result result = new Result();
result.setCode(0);
result.setMsg("查找成功！");
result.setCount(totalDepartments);
result.setData(departmentList);
return result;
}

DepartmentController.java ：

@GetMapping("/department/listbyname")
@ResponseBody
public Result listByName(@RequestParam Map<String, Object> params) {
int page = Integer.parseInt(params.get("page").toString());
int limit = Integer.parseInt(params.get("limit").toString());
int start = (page - 1) * limit;
String dname = params.get("dname").toString();
return departmentService.getDepartmentsListByName(dname, start, limit);
}

刷新页面：

AuserController.java ：

@GetMapping("/reload")
@ResponseBody
public boolean reload(HttpSession session) {
String name = session.getAttribute("name").toString();
return name != null;
}

增

为保证部门名称不重复，对 dname 字段设置唯一性约束：

DepartmentController.java ：

@GetMapping("/department/add")
public String gotoDepartmentAdd() {
return "admin/department-add";
}

修改 DepartmentMapper.java 中已自动生成方法的返回类型：

boolean insertSelective(Department record);

DepartmentService.java ：

Result addDepartment(Department department);

DepartmentServiceImpl.java ：

@Override
public Result addDepartment(Department department) {
Result result = new Result();
if(departmentMapper.insertSelective(department)){
result.setCode(0);
result.setMsg("新建成功！");
}else{
result.setCode(1);
result.setMsg("新建失败！");
}
return result;
}

DepartmentController.java ：

@PostMapping("/department/add")
@ResponseBody
public Result addDepartment(@RequestParam("dname") String dname,
@RequestParam("dtel") String dtel, @RequestParam("description") String
description) {
Department department = new Department();
department.setDname(dname);
department.setDtel(dtel);
department.setDescription(description);
department.setEstablishmentdate(new Date());
return departmentService.addDepartment(department);
}

或通过 @RequestParam 获取 Map 键值对传参：

@PostMapping("/department/add")
@ResponseBody
public Result addDepartment(@RequestParam Map<String, Object> map) {
Department department = new Department();
department.setDname(map.get("dname").toString());
department.setDtel(map.get("dtel").toString());
department.setDescription(map.get("description").toString());
department.setEstablishmentdate(new Date());
return departmentService.addDepartment(department);
}

或通过 @RequestBody 获取 Map 键值对传参，但需要修改 department-add.html 的数据提交格式为 json 格式：

@PostMapping("/department/add")
@ResponseBody
public Result addDepartment(@RequestBody Map<String, Object> map) {
Department department = new Department();
department.setDname(map.get("dname").toString());
department.setDtel(map.get("dtel").toString());
department.setDescription(map.get("description").toString());
department.setEstablishmentdate(new Date());
return departmentService.addDepartment(department);
}

department-add.html 中的

data: data.field,

替换为

data: JSON.stringify(data.field),
contentType : "application/json",