人事管理系统6

模糊查询

DepartmentMapper.xml :

复制代码
<select id="findDepartmentListByName" resultMap="BaseResultMap">
select
<include refid="Base_Column_List"/>
from department
where dname like '%${dname}%' /*where dname like concat('%',#
{dname},'%')*/
order by establishmentdate desc
limit #{start},#{limit}
</select>
<!--#会把传入的String类型自动加上引号,其他数据类型不会加引号,此处会变成'%'开发部'%',语法错
误-->
<!--$把传入的数据直接显示在sql语句中,不会添加引号,此处会变成'%开发部%'-->
<select id="getTotalDepartmentsByName" resultType="int">
select count(*) from department where dname like '%${dname}%'
</select>

{} :不安全 直接拼接 SQL ,容易被 SQL 注入攻击利用。 select \* from user where username = '{username}'
若用户输入 admin' or '1'='1 会直接执行
select * from user where username='admin' or '1'='1'
${} 是拼接符
#{} :安全
通过预编译方式传参,防止 SQL 注入
select * from user where username = #{username}
#{} 是占位符
DepartmentMapper.java :

复制代码
List<Department> findDepartmentListByName(@Param("dname") String
dname,@Param("start") int start,@Param("limit") int limit);
int getTotalDepartmentsByName(@Param("dname") String dname);

DepartmentService.java :

复制代码
Result getDepartmentsListByName(String dname, int start, int limit);

DepartmentServiceImpl.java :

复制代码
@Override
public Result getDepartmentsListByName(String dname, int start, int limit) {
List<Department> departmentList =
departmentMapper.findDepartmentListByName(dname, start, limit);
int totalDepartments = departmentMapper.getTotalDepartmentsByName(dname);
Result result = new Result();
result.setCode(0);
result.setMsg("查找成功!");
result.setCount(totalDepartments);
result.setData(departmentList);
return result;
}

DepartmentController.java :

复制代码
@GetMapping("/department/listbyname")
@ResponseBody
public Result listByName(@RequestParam Map<String, Object> params) {
int page = Integer.parseInt(params.get("page").toString());
int limit = Integer.parseInt(params.get("limit").toString());
int start = (page - 1) * limit;
String dname = params.get("dname").toString();
return departmentService.getDepartmentsListByName(dname, start, limit);
}

刷新页面:

AuserController.java :

复制代码
@GetMapping("/reload")
@ResponseBody
public boolean reload(HttpSession session) {
String name = session.getAttribute("name").toString();
return name != null;
}

为保证部门名称不重复,对 dname 字段设置唯一性约束:


DepartmentController.java :

复制代码
@GetMapping("/department/add")
public String gotoDepartmentAdd() {
return "admin/department-add";
}

修改 DepartmentMapper.java 中已自动生成方法的返回类型:

复制代码
boolean insertSelective(Department record);

DepartmentService.java :

复制代码
Result addDepartment(Department department);

DepartmentServiceImpl.java :

复制代码
@Override
public Result addDepartment(Department department) {
Result result = new Result();
if(departmentMapper.insertSelective(department)){
result.setCode(0);
result.setMsg("新建成功!");
}else{
result.setCode(1);
result.setMsg("新建失败!");
}
return result;
}

DepartmentController.java :

复制代码
@PostMapping("/department/add")
@ResponseBody
public Result addDepartment(@RequestParam("dname") String dname,
@RequestParam("dtel") String dtel, @RequestParam("description") String
description) {
Department department = new Department();
department.setDname(dname);
department.setDtel(dtel);
department.setDescription(description);
department.setEstablishmentdate(new Date());
return departmentService.addDepartment(department);
}

或通过 @RequestParam 获取 Map 键值对传参:

复制代码
@PostMapping("/department/add")
@ResponseBody
public Result addDepartment(@RequestParam Map<String, Object> map) {
Department department = new Department();
department.setDname(map.get("dname").toString());
department.setDtel(map.get("dtel").toString());
department.setDescription(map.get("description").toString());
department.setEstablishmentdate(new Date());
return departmentService.addDepartment(department);
}

或通过 @RequestBody 获取 Map 键值对传参,但需要修改 department-add.html 的数据提交格式为 json 格式:

复制代码
@PostMapping("/department/add")
@ResponseBody
public Result addDepartment(@RequestBody Map<String, Object> map) {
Department department = new Department();
department.setDname(map.get("dname").toString());
department.setDtel(map.get("dtel").toString());
department.setDescription(map.get("description").toString());
department.setEstablishmentdate(new Date());
return departmentService.addDepartment(department);
}

department-add.html 中的

复制代码
data: data.field,

替换为

复制代码
data: JSON.stringify(data.field),
contentType : "application/json",
相关推荐
唐可盐1 小时前
第六章 SQL编程系列-Gbase8a从入门到进阶
数据库·sql·gbase8a
R-sz1 小时前
java流式计算 获取全量树形数据,非懒加载树,递归找儿
java·开发语言·windows
柳鲲鹏9 小时前
WINDOWS最快布署WEB服务器:apache2
服务器·前端·windows
专注VB编程开发20年11 小时前
开机自动后台运行,在Windows服务中托管ASP.NET Core
windows·后端·asp.net
喜欢敲代码的程序员12 小时前
SpringBoot+Mybatis+MySQL+Vue+ElementUI前后端分离版:项目搭建(一)
spring boot·mysql·elementui·vue·mybatis
DataGear13 小时前
如何在DataGear 5.4.1 中快速制作SQL服务端分页的数据表格看板
javascript·数据库·sql·信息可视化·数据分析·echarts·数据可视化
数据狐(DataFox)13 小时前
SQL参数化查询:防注入与计划缓存的双重优势
数据库·sql·缓存
李洋-蛟龙腾飞公司14 小时前
HarmonyOS NEXT应用元服务常见列表操作分组吸顶场景
linux·运维·windows
码农垦荒笔记14 小时前
Git 安装闭坑指南(仅 Windows 环境)
windows·git
阿幸软件杂货间15 小时前
Windows 10 2016 长期服务版
windows·系统·win10