简体   繁体   English

DynamicJasper AutoText字段中的参数?

[英]Parameters in DynamicJasper AutoText fields?

Given a report with a parameter, say foo with value bar , I'd expect the following to either print bar if it supported parameters, or $P{foo} if it only supported static text. 给定一个带有参数的报告,比如说foo with value bar ,我希望以下内容在支持参数的情况下打印bar ,或者在仅支持静态文本的情况下打印$P{foo}

    AutoText showBatchAutoText = new AutoText("$P{foo}",
                                 AutoText.POSITION_HEADER,
                                 HorizontalBandAlignment.CENTER);

Instead it prints ((java.lang.String)parameter_foo.getValue()) , implying it does some kind of logic on the field... 而是打印((java.lang.String)parameter_foo.getValue()) ,暗示它在字段上执行了某种逻辑...

Is it supposed to work? 它应该工作吗? Am I misusing the "message" type AutoText? 我是否在滥用“消息”类型的自动图文集?

DynamicJasper wraps the string in quotes before sending it to Jasper. DynamicJasper在将字符串发送给Jasper之前,将其用引号引起来。 So, sql injection attack style, you can bypass it with escaped quotes. 因此, sql注入攻击样式可以用转义引号将其绕开。

AutoText showBatchAutoText = new AutoText("\" + $P{foo} + \"",
                             AutoText.POSITION_HEADER,
                             HorizontalBandAlignment.CENTER);

A hack, but... it does the trick. 骇客,但是...可以解决问题。

声明:本站的技术帖子网页,遵循CC BY-SA 4.0协议,如果您需要转载,请注明本站网址或者原文地址。任何问题请咨询:yoyou2525@163.com.

 
粤ICP备18138465号  © 2020-2024 STACKOOM.COM