基于用户搜索的java动态where子句

Question

Hi i need to dynamically build a query based on user selection. I cant write where conditions with if statement because i have 50 columns in table.is there a way without if statements?

Answer 1

You can look on CrtitriaAPI or you can use hibernate feature Query by example

Actually if you are using spring with spring data module you can look into Specifications

Please look into below links:

https://dzone.com/articles/hibernate-query-example-qbe https://vladmihalcea.com/query-entity-type-jpa-criteria-api/ https://spring.io/blog/2011/04/26/advanced-spring-data-jpa-specifications-and-querydsl/

Answer 2

Do you mean how to avoid the sql injection like concatenating sql statements at runtime?

    static final String INVOICE_QUERY = "SELECT inv from Invoice inv WHERE (:createDate IS NULL OR inv.createDate = :createDate) AND (:quantity IS NULL OR inv.quantity = :quantity) AND (:custName IS NULL OR inv.custName = :custName)";
    Session session = getHibernateTemplate().getSessionFactory().openSession();

    Query query = session.createQuery(INVOICE_QUERY);
    query.setDate("createDate", createDate);
    if(quantity != null)
        query.setLong("quantity", quantity);
    else
        query.setBigInteger("quantity", null);
    if(StringUtils.isNotBlank(custName))
        query.setString("custName", custName);
    else
        query.setString("custName", null);
    return query.list();