Hibernate : How to prevent SQL injection when the collection elements needs to check with `like` operator?
问题 I am having a query something like this. StringBuilder sbQry = new StringBuilder(); sbQry.append("select * from tableName where 1=1"); if(!myCollection.isEmpty()){ sbQry.append(" and ("); for (int i = 0; i < myCollection.size(); i++) { final String module = myCollection.get(i); sbQry.append("column = '" + module + "' or column like 'J_'||'" + module.replaceAll("-", "%") + "'"); if (!(i == (myCollection.size() - 1))) { sbQry.append(" or "); } } sbQry.append(") "); } Here this query sbQry is