有什么更好的方法检查JdbcTemplate.batchUpdate中的名称字段，名称表的SQL注入？

Question

In insert query I use SEQUENCE, because of this I refused to use SimpleJdbcInsert....executeBatch(data);

String sql = "INSERT INTO "+ schema +"."+ tableName +" (id, " + fieldName1 + ", " + fieldName2 + ") VALUES (BUF_SEQ.nextval, ?, ?)";
List<Object[]> recordValues = new ArrayList<Object[]>();
//... add values of records to recordValues list

// run bash update for insert
jdbcTemplate.batchUpdate(sql, recordValues);

Maybe someone can suggest a better way use Springframework jdbc? To insert a large number of records. To test the field names in the SQL injection. ?

Answer 1

1) Instead of calling sequence in your insert query, create a trigger on id column of the table for insert. Take ref : How to create id with AUTO_INCREMENT on Oracle?
2) Now use Batch update of spring to do bulk insertion ie jdbcTemplate.batchUpdate
In your insert query now you no longer need to define id, every time you make insertion on the table, trigger will be fired and id will be incremented.
3) Use Prepared Statement for insert query in order to avoid sql injection.