feat:sql注入

rpc/service/datasmt.go

@@ -1,13 +1,14 @@
 package service
 
 import (
+	"fmt"
+	"strings"
+
 	"app.yhyue.com/moapp/jybase/common"
 	"app.yhyue.com/moapp/jybase/encrypt"
-	"fmt"
 	"jygit.jydev.jianyu360.cn/ApplicationCenter/publicService/rpc/db"
 	"jygit.jydev.jianyu360.cn/ApplicationCenter/publicService/rpc/internal/config"
 	"jygit.jydev.jianyu360.cn/ApplicationCenter/publicService/rpc/pb"
-	"strings"
 )
 
 const (
@@ -37,18 +38,21 @@ func (d *DataSmt) List(searchValue, dataType string, pageNum, pageSize int64) *p
 	}
 	//数据查询
 	data := &[]map[string]interface{}{}
-	querySql := "select  id,name,data_type,format,clear_status from  %s where %s ORDER BY serial_number, update_time desc,CONVERT(name USING gbk) asc,id desc  limit %v ,%v "
+	querySql := "select id,name,data_type,format,clear_status from %s where %s ORDER BY serial_number, update_time desc,CONVERT(name USING gbk) asc,id desc limit %v ,%v "
 	queryStrArr := []string{
 		" status=1 ",
 	}
+	args := []interface{}{}
 	if searchValue != "" {
-		queryStrArr = append(queryStrArr, " name  LIKE '%"+searchValue+"%' ")
+		queryStrArr = append(queryStrArr, " name LIKE ? ")
+		args = append(args, "%"+searchValue+"%")
 	}
 	if dataType != "" {
-		queryStrArr = append(queryStrArr, fmt.Sprintf(" data_type  = '%s' ", dataType))
+		queryStrArr = append(queryStrArr, " data_type=? ")
+		args = append(args, dataType)
 	}
 	querySql = fmt.Sprintf(querySql, DATA_SUPERMARKET, strings.Join(queryStrArr, " and "), (pageNum-1)*pageSize, pageSize)
-	data = db.Mysql_BaseService.SelectBySql(querySql)
+	data = db.Mysql_BaseService.SelectBySql(querySql, args...)
 	if data != nil && len(*data) > 0 {
 		//数据处理
 		dataList := []*pb.DatasmtList{}
@@ -64,12 +68,12 @@ func (d *DataSmt) List(searchValue, dataType string, pageNum, pageSize int64) *p
 		result.List = dataList
 	}
 	//总数查询
-	countQuerySql := "select  count(id) from  %s where %s "
+	countQuerySql := "select count(id) from %s where %s "
 	countQuerySql = fmt.Sprintf(countQuerySql, DATA_SUPERMARKET, strings.Join(queryStrArr, " and "))
-	count := db.Mysql_BaseService.CountBySql(countQuerySql)
+	count := db.Mysql_BaseService.CountBySql(countQuerySql, args...)
 	result.PageCount = count
 	//热搜词处理
-	hotKeySql := fmt.Sprintf(" select a.keyword as keyword from (SELECT  keyword,min(serial_number) as serial_number,max(update_time) as update_time FROM %s where keyword<>'' and keyword is not null and  status=1 GROUP BY keyword ) a ORDER BY a.serial_number, a.update_time desc,CONVERT(a.keyword USING gbk) asc  limit 8", DATA_SUPERMARKET)
+	hotKeySql := fmt.Sprintf(" select a.keyword as keyword from (SELECT keyword,min(serial_number) as serial_number,max(update_time) as update_time FROM %s where keyword<>'' and keyword is not null and  status=1 GROUP BY keyword ) a ORDER BY a.serial_number, a.update_time desc,CONVERT(a.keyword USING gbk) asc limit 8", DATA_SUPERMARKET)
 	hotData := db.Mysql_BaseService.SelectBySql(hotKeySql)
 	hotKeyArr := []string{}
 	for _, m := range *hotData {
@@ -83,8 +87,8 @@ func (d *DataSmt) List(searchValue, dataType string, pageNum, pageSize int64) *p
 // 详情
 func (d *DataSmt) Detail(id string) *pb.DatasmtRespDetail {
 	result := &pb.DatasmtRespDetail{}
-	querySql := fmt.Sprintf("select  id,name,data_type,format,clear_status,data_example,introduce,keyword from   %s where id =%s", DATA_SUPERMARKET, id)
-	data := db.Mysql_BaseService.SelectBySql(querySql)
+	querySql := fmt.Sprintf("select id,name,data_type,format,clear_status,data_example,introduce,keyword from %s where id=?", DATA_SUPERMARKET)
+	data := db.Mysql_BaseService.SelectBySql(querySql, id)
 	if data != nil && len(*data) > 0 {
 		//数据处理
 		v := (*data)[0]