SQL Injection: MyBatis Mapper(SQL注入：MyBatis Mapper)

amos-boot-module/amos-boot-module-api/amos-boot-module-common-api/src/main/resources/mapper/DutyPersonShiftMapper.xml

@@ -292,7 +292,7 @@ select * from (
 		group by cd.instance_id
 ) result 
 		<if test="groupByName != null and  groupByName!='' ">
-			group by ${groupByName}
+			group by #{groupByName}
 		</if>
 	</select>
 	
@@ -335,7 +335,7 @@ select * from (
 		group by cd.instance_id
 ) result 
 		<if test="groupByName != null and  groupByName!='' ">
-			group by ${groupByName}
+			group by #{groupByName}
 		</if>
 	</select>
 	

amos-boot-module/amos-boot-module-api/amos-boot-module-common-api/src/main/resources/mapper/DynamicFormInstanceMapper.xml

@@ -54,7 +54,7 @@
         i.INSTANCE_ID instanceId,
         i.GROUP_CODE groupCode,
         <foreach collection="fieldCodes" item="value" index="key" separator=",">
-            MAX(CASE WHEN i.FIELD_CODE = #{key} THEN i.FIELD_VALUE END) as ${key}
+            MAX(CASE WHEN i.FIELD_CODE = #{key} THEN i.FIELD_VALUE END) as #{key}
         </foreach>
         from
         cb_dynamic_form_instance i
@@ -92,7 +92,7 @@
         i.INSTANCE_ID instanceId,
         i.GROUP_CODE groupCode
         <foreach collection="fieldCodes" item="value" index="key">
-            ,MAX(CASE WHEN i.FIELD_CODE = #{key} THEN i.FIELD_VALUE END) as ${key}
+            ,MAX(CASE WHEN i.FIELD_CODE = #{key} THEN i.FIELD_VALUE END) as #{key}
         </foreach>
         from
         cb_dynamic_form_instance i
@@ -107,16 +107,16 @@
             <foreach collection="params" index="key" item="value" separator="">
                 <choose>
                     <when test="fieldCodes[key] == 'like' and value !=null and value !=''">
-                        and d.${key} like concat('%',#{value},'%')
+                        and d.#{key} like concat('%',#{value},'%')
                     </when>
                     <when test="fieldCodes[key] == 'eq' and value !=null and value !=''">
-                        and d.${key} = #{value}
+                        and d.#{key} = #{value}
                     </when>
                     <when test="fieldCodes[key] == 'ge' and value !=null and value !=''">
-                        and d.${key} >= #{value}
+                        and d.#{key} >= #{value}
                     </when>
                     <when test="fieldCodes[key] == 'le' and value !=null and value !=''">
-                        and d.${key} <![CDATA[<=]]> #{value}
+                        and d.#{key} <![CDATA[<=]]> #{value}
                     </when>
                 </choose>
             </foreach>
@@ -132,9 +132,9 @@
         i.INSTANCE_ID instanceId,
         i.GROUP_CODE groupCode
         <foreach collection="fieldCodes" item="value" index="key" >
-           , MAX(CASE WHEN i.FIELD_CODE = #{key} THEN i.FIELD_VALUE END) as ${key},
+           , MAX(CASE WHEN i.FIELD_CODE = #{key} THEN i.FIELD_VALUE END) as #{key},
             IF(FIND_IN_SET(i.field_type,'radio,select,treeSelect'), MAX(CASE WHEN i.FIELD_CODE = #{key} THEN
-            i.FIELD_VALUE_LABEL END), null) as ${key}Label
+            i.FIELD_VALUE_LABEL END), null) as #{key}Label
         </foreach>
         from
         cb_dynamic_form_instance i
@@ -157,10 +157,10 @@
             <foreach collection="params" index="key" item="value" separator="">
                 <choose>
                     <when test="fieldCodes[key] == 'like' and value !=null and value !=''">
-                        and d.${key} like concat('%',#{value},'%')
+                        and d.#{key} like concat('%',#{value},'%')
                     </when>
                     <when test="fieldCodes[key] == 'eq' and value !=null and value !=''">
-                        and d.${key} = #{value}
+                        and d.#{key} = #{value}
                     </when>
                 </choose>
             </foreach>
@@ -190,7 +190,7 @@
         i.INSTANCE_ID instanceId,
         i.GROUP_CODE groupCode
         <foreach collection="fieldCodes" item="value" index="key" >
-          , MAX(CASE WHEN i.FIELD_CODE = #{key} THEN i.FIELD_VALUE END) as ${key}
+          , MAX(CASE WHEN i.FIELD_CODE = #{key} THEN i.FIELD_VALUE END) as #{key}
         </foreach>
         from
         cb_dynamic_form_instance i
@@ -211,10 +211,10 @@
             <foreach collection="params" index="key" item="value" separator="">
                 <choose>
                     <when test="fieldCodes[key] == 'like' and value !=null and value !=''">
-                        and d.${key} like concat('%',#{value},'%')
+                        and d.#{key} like concat('%',#{value},'%')
                     </when>
                     <when test="fieldCodes[key] == 'eq' and value !=null and value !=''">
-                        and d.${key} = #{value}
+                        and d.#{key} = #{value}
                     </when>
                 </choose>
             </foreach>
@@ -234,7 +234,7 @@
         i.INSTANCE_ID instanceId,
         i.GROUP_CODE groupCode,
         <foreach collection="fieldCodes" item="value" index="key" separator=",">
-            MAX(CASE WHEN i.FIELD_CODE = #{key} THEN i.FIELD_VALUE END) as ${key}
+            MAX(CASE WHEN i.FIELD_CODE = #{key} THEN i.FIELD_VALUE END) as #{key}
         </foreach>
         from
         cb_dynamic_form_instance i
@@ -274,7 +274,7 @@
         i.INSTANCE_ID instanceId,
         i.GROUP_CODE groupCode,
         <foreach collection="fieldCodes" item="value" index="key" separator=",">
-            MAX(CASE WHEN i.FIELD_CODE = #{key} THEN i.FIELD_VALUE END) as ${key}
+            MAX(CASE WHEN i.FIELD_CODE = #{key} THEN i.FIELD_VALUE END) as #{key}
         </foreach>
         ,
         IFNULL(( SELECT c.field_value FROM cb_dynamic_form_instance c, `cb_org_usr` WHERE field_code = 'telephone' AND c.instance_id = `cb_org_usr`.sequence_nbr AND `cb_org_usr`.sequence_nbr = MAX(CASE WHEN i.FIELD_CODE = 'userId' THEN i.FIELD_VALUE END) ), "" ) AS telephone
@@ -333,9 +333,9 @@
         i.INSTANCE_ID instanceId,
         i.GROUP_CODE groupCode
         <foreach collection="fieldCodes" item="value" index="key" >
-            ,MAX(CASE WHEN i.FIELD_CODE = #{key} THEN i.FIELD_VALUE END) as ${key},
+            ,MAX(CASE WHEN i.FIELD_CODE = #{key} THEN i.FIELD_VALUE END) as #{key},
             IF(FIND_IN_SET(i.field_type,'radio,select,treeSelect'), MAX(CASE WHEN i.FIELD_CODE = #{key} THEN
-            i.FIELD_VALUE_LABEL END), null) as ${key}Label
+            i.FIELD_VALUE_LABEL END), null) as #{key}Label
         </foreach>
         from
         cb_dynamic_form_instance i
@@ -361,16 +361,16 @@
             <foreach collection="params" index="key" item="value" separator="">
                 <choose>
                     <when test="fieldCodes[key] == 'like' and value !=null and value !=''">
-                        and d.${key} like concat('%',#{value},'%')
+                        and d.#{key} like concat('%',#{value},'%')
                     </when>
                     <when test="fieldCodes[key] == 'eq' and value !=null and value !=''">
-                        and d.${key} = #{value}
+                        and d.#{key} = #{value}
                     </when>
                     <when test="fieldCodes[key] == 'ge' and value !=null and value !=''">
-                        and d.${key} >= #{value}
+                        and d.#{key} >= #{value}
                     </when>
                     <when test="fieldCodes[key] == 'le' and value !=null and value !=''">
-                        and d.${key} <![CDATA[<=]]> #{value}
+                        and d.#{key} <![CDATA[<=]]> #{value}
                     </when>
                 </choose>
             </foreach>

amos-boot-module/amos-boot-module-api/amos-boot-module-common-api/src/main/resources/mapper/LinkageUnitMapper.xml

@@ -16,7 +16,7 @@
 		<foreach collection="fieldCodes" item="value" index="key"
 			separator=",">
 			MAX(CASE WHEN i.FIELD_CODE = #{key} THEN i.FIELD_VALUE END)
-			as ${key}
+			as #{key}
 		</foreach>
 		from
 		cb_dynamic_form_instance i

amos-boot-module/amos-boot-module-api/amos-boot-module-common-api/src/main/resources/mapper/OrgUsrMapper.xml

@@ -110,7 +110,7 @@
                                             <foreach collection="map.fieldsValue.keys" item="item">
 
                                                 <if test="item !=  'bizOrgName'">
-                                                    AND a.${item} = #{map.fieldsValue[${item}]}
+                                                    AND a.#{item} = #{map.fieldsValue[#{item}]}
                                                 </if>
 
 
@@ -218,7 +218,7 @@
             <if test="map.fieldsValue != null">
                 <foreach collection="map.fieldsValue.keys" item="item">
                     <if test="item !=  'bizOrgName'">
-                        AND a.${item} = #{map.fieldsValue[${item}]}
+                        AND a.#{item} = #{map.fieldsValue[#{item}]}
                     </if>
                 </foreach>
             </if>
@@ -251,7 +251,7 @@
         u.biz_org_code bizOrgCode,
         <if test="fields != null">
             <foreach collection="fields" item="item" separator=",">MAX(case f.field_code when #{item} then IFNULL(v.field_value_label, v.field_value)
-                end) ${item}
+                end) #{item}
             </foreach>
         </if>
         FROM

amos-boot-module/amos-boot-module-api/amos-boot-module-jcs-api/src/main/resources/mapper/AlertCalledMapper.xml

@@ -275,17 +275,17 @@
                 and a.alert_source_code = #{alertSourceCode}
             </if>
             <if test="systemSourceCode!= null ">
-                and a.system_source_code in  (${systemSourceCode})
+                and a.system_source_code in  (#{systemSourceCode})
             </if>
             <if test="isFatherAlert != null and isFatherAlert == 'true' ">
                 and   j.alert_called_id = a.sequence_nbr
                 GROUP BY a.sequence_nbr
             </if>
             <if test="data == 'address' and data != null and lift != null ">
-                order by  CONVERT(address USING 'gbk') ${lift}  limit #{current},#{size}
+                order by  CONVERT(address USING 'gbk') #{lift}  limit #{current},#{size}
             </if>
             <if test="data != null and data != 'address' and lift != null ">
-                order by ${data}  ${lift}     limit #{current},#{size}
+                order by #{data}  #{lift}     limit #{current},#{size}
             </if>
             <if test="data == null ">
                 order by a.call_time DESC  limit #{current},#{size}
@@ -318,7 +318,7 @@
                 and a.alert_source_code = #{alertSourceCode}
             </if>
             <if test="systemSourceCode!= null ">
-                and a.system_source_code in (${systemSourceCode})
+                and a.system_source_code in (#{systemSourceCode})
             </if>
             <if test="isFatherAlert!= null and isFatherAlert == 'true' ">
                 and j.alert_called_id = a.sequence_nbr
@@ -411,10 +411,10 @@
             GROUP BY a.sequence_nbr
         </if>
         <if test="data == 'address' and data != null and lift != null ">
-            order by  CONVERT(address USING 'gbk') ${lift}  limit #{current},#{size}
+            order by  CONVERT(address USING 'gbk') #{lift}  limit #{current},#{size}
         </if>
         <if test="data != null and data != 'address' and lift != null ">
-            order by ${data}  ${lift}     limit #{current},#{size}
+            order by #{data}  #{lift}     limit #{current},#{size}
         </if>
         <if test="data == null ">
             order by a.call_time DESC  limit #{current},#{size}

amos-boot-module/amos-boot-module-api/amos-boot-module-jcs-api/src/main/resources/mapper/AlertFormValueMapper.xml

@@ -32,7 +32,7 @@
 		i.alert_type_code groupCode,
 		i.rec_date recDate,
 		<foreach collection="fieldCodes" item="item" index="key" separator=",">
-			MAX(CASE WHEN i.FIELD_CODE = #{item} THEN i.FIELD_VALUE ELSE '' END) as ${item}
+			MAX(CASE WHEN i.FIELD_CODE = #{item} THEN i.FIELD_VALUE ELSE '' END) as #{item}
 		</foreach>
 		from
 		jc_alert_form_value i

amos-boot-module/amos-boot-module-api/amos-boot-module-jcs-api/src/main/resources/mapper/AlertSubmittedMapper.xml

@@ -83,7 +83,7 @@
                 LEFT JOIN jc_template t ON s.business_type_code = t.type_code
                 AND t.format = 1
         WHERE
-            o.sequence_nbr = ${id}
+            o.sequence_nbr = #{id}
     </select>
 
 
@@ -110,7 +110,7 @@
         jc_alert_submitted a
         LEFT JOIN jc_alert_submitted_object b ON a.sequence_nbr = b.alert_submitted_id
         WHERE
-        a.alert_called_id = ${id}
+        a.alert_called_id = #{id}
         ) g
         GROUP BY
         g.business_type,
@@ -129,7 +129,7 @@
 	jc_alert_submitted a
 	LEFT JOIN jc_alert_submitted_object b ON a.sequence_nbr = b.alert_submitted_id
 	WHERE
-	a.alert_called_id =  ${id}
+	a.alert_called_id =  #{id}
     </select>
 
     <select id="getFirst" resultType="Map">

amos-boot-module/amos-boot-module-api/amos-boot-module-jcs-api/src/main/resources/mapper/PowerTransferCompanyMapper.xml

@@ -27,7 +27,7 @@ FROM
 		LEFT JOIN jc_power_transfer_company b ON a.sequence_nbr = b.power_transfer_id
 		LEFT JOIN jc_power_transfer_company_resources c ON b.sequence_nbr = c.power_transfer_company_id
 	WHERE
-		a.alert_called_id = ${id}
+		a.alert_called_id = #{id}
 	) g
 GROUP BY
 	g.company_name,

amos-boot-module/amos-boot-module-api/amos-boot-module-jcs-api/src/main/resources/mapper/PowerTransferMapper.xml

@@ -152,7 +152,7 @@
 	LEFT JOIN jc_power_transfer_company b ON a.sequence_nbr = b.power_transfer_id
 	LEFT JOIN jc_power_transfer_company_resources c ON c.power_transfer_company_id = b.sequence_nbr
     WHERE
-	a.alert_called_id = ${id}
+	a.alert_called_id = #{id}
     </select>
 
 
@@ -164,7 +164,7 @@
         LEFT JOIN jc_power_transfer_company b ON a.sequence_nbr = b.power_transfer_id
         LEFT JOIN jc_power_transfer_company_resources c ON c.power_transfer_company_id = b.sequence_nbr
         WHERE
-        a.alert_called_id = ${id}
+        a.alert_called_id = #{id}
 
 
 
@@ -187,14 +187,14 @@
         LEFT JOIN jc_power_transfer_company b ON a.sequence_nbr = b.power_transfer_id
         LEFT JOIN jc_power_transfer_company_resources c ON c.power_transfer_company_id = b.sequence_nbr
     WHERE
-        a.alert_called_id  = ${id} UNION ALL
+        a.alert_called_id  = #{id} UNION ALL
     SELECT DISTINCT
         b.company_id
     FROM
         jc_alert_submitted a
         LEFT JOIN jc_alert_submitted_object b ON a.sequence_nbr = b.alert_submitted_id
     WHERE
-        a.alert_called_id = ${id}) m
+        a.alert_called_id = #{id}) m
         </select>
 
         <select id="getPowerDataList" resultType="com.yeejoin.amos.boot.module.jcs.api.dto.PowerData">
@@ -210,7 +210,7 @@
         LEFT JOIN jc_power_transfer_company_resources c ON c.power_transfer_company_id = b.sequence_nbr
         LEFT JOIN jc_user_car u ON c.resources_id =  u.car_id
     WHERE
-        a.alert_called_id = ${id}
+        a.alert_called_id = #{id}
     </select>
 
     <select id="getPowerDataOne" resultType="com.yeejoin.amos.boot.module.jcs.api.dto.PowerData">
@@ -231,7 +231,7 @@
         on cb.instance_id  = d.id4
         ) u where
         to_days(u.duty_date) = to_days(now())
-        and   u.carId = ${carId}
+        and   u.carId = #{carId}
     </select>
 
     <select id="getPowerDataOther" resultType="com.yeejoin.amos.boot.module.jcs.api.dto.PowerData">
@@ -242,7 +242,7 @@
         LEFT JOIN jc_power_transfer_company b ON a.sequence_nbr = b.power_transfer_id
         LEFT JOIN jc_power_transfer_company_resources c ON c.power_transfer_company_id = b.sequence_nbr
     WHERE
-        a.alert_called_id = ${alertId} and c.resources_id = ${carId}  ORDER BY c.rec_date LIMIT 1
+        a.alert_called_id = #{alertId} and c.resources_id = #{carId}  ORDER BY c.rec_date LIMIT 1
     </select>
 
     <select id="getPowerDataCar" resultType="com.yeejoin.amos.boot.module.jcs.api.dto.PowerData">
@@ -277,7 +277,7 @@
         LEFT JOIN jc_power_transfer_company b ON a.sequence_nbr = b.power_transfer_id
         LEFT JOIN jc_power_transfer_company_resources c ON c.power_transfer_company_id = b.sequence_nbr
     WHERE
-        a.alert_called_id = ${id}
+        a.alert_called_id = #{id}
     GROUP BY
         b.company_id,
         b.company_name
@@ -293,8 +293,8 @@
         LEFT JOIN jc_power_transfer_company b ON a.sequence_nbr = b.power_transfer_id
         LEFT JOIN jc_power_transfer_company_resources c ON c.power_transfer_company_id = b.sequence_nbr
     WHERE
-        a.alert_called_id = ${alertCalledId}
-        AND b.company_id = ${companyId}
+        a.alert_called_id = #{alertCalledId}
+        AND b.company_id = #{companyId}
     GROUP BY
         c.resources_name ) m where m.carNum>0
     </select>

amos-boot-module/amos-boot-module-api/amos-boot-module-jcs-api/src/main/resources/mapper/VoiceRecordFileMapper.xml

@@ -45,7 +45,7 @@
         </if>
         <choose>
             <when test="sortParam != null and sortParam != '' and sortRule != null and sortRule != ''    ">
-                ORDER BY r.${sortParam} ${sortRule}
+                ORDER BY r.#{sortParam} #{sortRule}
             </when>
             <otherwise>
                 ORDER BY r.tel_start_time desc

amos-boot-system-equip/src/main/resources/mapper/FormInstanceEquipMapper.xml

@@ -15,7 +15,7 @@
         i.INSTANCE_ID instanceId,
         i.GROUP_CODE groupCode,
         <foreach collection="fieldNames" item="value" index="key" separator=",">
-            MAX(CASE WHEN i.FIELD_NAME = #{key} THEN i.FIELD_VALUE END) as ${key}
+            MAX(CASE WHEN i.FIELD_NAME = #{key} THEN i.FIELD_VALUE END) as #{key}
         </foreach>
         from
         wl_form_instance_equip i
@@ -28,10 +28,10 @@
             <foreach collection="params" index="key" item="value" separator="">
                 <choose>
                     <when test="fieldNames[key] == 'like' and value !=null and value !=''">
-                        and d.${key} like concat('%',#{value},'%')
+                        and d.#{key} like concat('%',#{value},'%')
                     </when>
                     <when test="fieldNames[key] == 'eq' and value !=null and value !=''">
-                        and d.${key} = #{value}
+                        and d.#{key} = #{value}
                     </when>
                 </choose>
             </foreach>
@@ -67,7 +67,7 @@
         i.INSTANCE_ID instanceId,
         i.GROUP_CODE groupCode
         <foreach collection="fieldNames" item="value" open="," index="key" separator=",">
-            MAX( CASE WHEN i.FIELD_NAME = #{key} THEN i.FIELD_VALUE END) ${key}
+            MAX( CASE WHEN i.FIELD_NAME = #{key} THEN i.FIELD_VALUE END) #{key}
         </foreach>
         from
         wl_form_instance_equip i
@@ -80,10 +80,10 @@
             <foreach collection="params" index="key" item="value" separator="">
                 <choose>
                     <when test="fieldNames[key] == 'like' and value !=null and value !=''">
-                        AND d.${key} like concat('%',#{value},'%')
+                        AND d.#{key} like concat('%',#{value},'%')
                     </when>
                     <when test="fieldNames[key] == 'eq' and value !=null and value !=''">
-                        AND d.${key} = #{value}
+                        AND d.#{key} = #{value}
                     </when>
                 </choose>
 

amos-boot-system-equip/src/main/resources/mapper/FormInstanceMapper.xml

@@ -15,7 +15,7 @@
         i.INSTANCE_ID instanceId,
         i.GROUP_CODE groupCode,
         <foreach collection="fieldNames" item="value" index="key" separator=",">
-            MAX(CASE WHEN i.FIELD_NAME = #{key} THEN i.FIELD_VALUE END) as ${key}
+            MAX(CASE WHEN i.FIELD_NAME = #{key} THEN i.FIELD_VALUE END) as #{key}
         </foreach>
         from
         wl_form_instance i
@@ -28,10 +28,10 @@
             <foreach collection="params" index="key" item="value" separator="">
                 <choose>
                     <when test="fieldNames[key] == 'like' and value !=null and value !=''">
-                        and d.${key} like concat('%',#{value},'%')
+                        and d.#{key} like concat('%',#{value},'%')
                     </when>
                     <when test="fieldNames[key] == 'eq' and value !=null and value !=''">
-                        and d.${key} = #{value}
+                        and d.#{key} = #{value}
                     </when>
                 </choose>
             </foreach>
@@ -67,7 +67,7 @@
         i.INSTANCE_ID instanceId,
         i.GROUP_CODE groupCode
         <foreach collection="fieldNames" item="value" open="," index="key" separator=",">
-            MAX( CASE WHEN i.FIELD_NAME = #{key} THEN i.FIELD_VALUE END) ${key}
+            MAX( CASE WHEN i.FIELD_NAME = #{key} THEN i.FIELD_VALUE END) #{key}
         </foreach>
         from
         wl_form_instance i
@@ -80,10 +80,10 @@
             <foreach collection="params" index="key" item="value" separator="">
                 <choose>
                     <when test="fieldNames[key] == 'like' and value !=null and value !=''">
-                        AND d.${key} like concat('%',#{value},'%')
+                        AND d.#{key} like concat('%',#{value},'%')
                     </when>
                     <when test="fieldNames[key] == 'eq' and value !=null and value !=''">
-                        AND d.${key} = #{value}
+                        AND d.#{key} = #{value}
                     </when>
                 </choose>
 

amos-boot-system-knowledgebase/src/main/resources/mapper/KnowledgeDocContentMapper.xml

@@ -38,7 +38,7 @@
             and dc.USER_ID = #{userId}
         </if>
         <if test="orgCode != null and orgCode !=''">
-            and dc.ORG_CODE like '%${orgCode}%'
+            and dc.ORG_CODE like '%#{orgCode}%'
         </if>
                 )
         UNION ALL
@@ -70,7 +70,7 @@
 		                and dc.USER_ID = #{userId}
         </if>
         <if test="orgCode != null and orgCode !=''">
-		                and dc.ORG_CODE like '%${orgCode}%'
+		                and dc.ORG_CODE like '%#{orgCode}%'
         </if>
                 )
                 )d LIMIT #{offset},#{length}
@@ -84,7 +84,7 @@
           (SELECT kdc.CATEGORY_NAME FROM knowledge_doc_category kdc WHERE kdc.SEQUENCE_NBR = DIRECTORY_ID) directoryName,
           <if test="extraFields != null and extraFields.size > 0">
             <foreach collection="extraFields" item="_field" >
-                ${_field},
+                #{_field},
             </foreach>
           </if>
           IFNULL(collectNum, 0) collectNum, IFNULL(quoteNum, 0) quoteNum, IFNULL(collect, "UNCOLLECT") collect
@@ -92,7 +92,7 @@
             SELECT INSTANCE_ID
               <if test="extraFields != null and extraFields.size > 0">
                   <foreach collection="extraFields" item="_field" >
-                      , MAX(CASE FIELD_NAME WHEN #{_field} THEN FIELD_VALUE ELSE NULL END) AS ${_field}
+                      , MAX(CASE FIELD_NAME WHEN #{_field} THEN FIELD_VALUE ELSE NULL END) AS #{_field}
                   </foreach>
               </if>
             FROM knowledge_dynamics_value
@@ -166,7 +166,7 @@
             </if>
             <if test="extraStrFilters != null and extraStrFilters.size > 0">
                 <foreach collection="extraStrFilters" item="str">
-                    AND ${str}
+                    AND #{str}
                 </foreach>
             </if>
         </where>
@@ -181,7 +181,7 @@
             SELECT INSTANCE_ID
                 <if test="extraFields != null and extraFields.size > 0">
                     <foreach collection="extraFields" item="_field" >
-                        , MAX(CASE FIELD_NAME WHEN #{_field} THEN FIELD_VALUE ELSE NULL END) AS ${_field}
+                        , MAX(CASE FIELD_NAME WHEN #{_field} THEN FIELD_VALUE ELSE NULL END) AS #{_field}
                     </foreach>
                 </if>
             FROM knowledge_dynamics_value
@@ -255,7 +255,7 @@
             </if>
             <if test="extraStrFilters != null and extraStrFilters.size > 0">
                 <foreach collection="extraStrFilters" item="str">
-                    AND ${str}
+                    AND #{str}
                 </foreach>
             </if>
         </where>

amos-boot-system-knowledgebase/src/main/resources/mapper/StatisticsRecordMapper.xml

@@ -343,7 +343,7 @@
 	<select id="tagChartStatistics" resultType="java.util.Map"
 		parameterType="java.util.Map">
 		SELECT
-		COUNT(1) AS datas,${splitSQL} AS level
+		COUNT(1) AS datas,#{splitSQL} AS level
 		FROM
 		knowledge_doc_content kdc
 		LEFT JOIN knowledge_tag_instance kti ON kti.TARGET_SEQ = kdc.SEQUENCE_NBR
@@ -353,7 +353,7 @@
 		WHERE
 	    kti.TAG_NAME = #{tag} AND ktv_time.TAG_VALUE BETWEEN #{startDate} AND #{endDate}
 		GROUP BY
-		${splitSQL}
+		#{splitSQL}
 	</select>
 
 	<select id="docChartStatistics" resultType="java.util.Map"
@@ -384,7 +384,7 @@
 	<select id="tagTimeChartStatistics" resultType="java.util.Map"
 		parameterType="java.util.Map">
 		SELECT
-			COUNT(1) AS datas ,${splitSQL} AS level
+			COUNT(1) AS datas ,#{splitSQL} AS level
 		FROM
 			(
 			SELECT
@@ -409,7 +409,7 @@
 			WHERE
 			   ktv_time.TAG_VALUE BETWEEN #{startDate} AND #{endDate}
 			GROUP BY
-				${splitSQL}
+				#{splitSQL}
 	</select>
 	
 	<select id="docBurnChartStatistics" resultType="java.util.Map"

amos-boot-system-patrol/src/main/resources/db/mapper/TaskReportMapper.xml

@@ -258,13 +258,13 @@
 		<if test="orgCode != null and orgCode !=''" >
 			And pp.org_code= #{orgCode}
 		</if>
-		AND d.create_date &gt;= '${startDate}'
-		AND d.create_date &lt;= '${endDate}'
+		AND d.create_date &gt;= '#{startDate}'
+		AND d.create_date &lt;= '#{endDate}'
 		<if test="planId != null and planId !=''" >
-			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.plan_id = ${planId})
+			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.plan_id = #{planId})
 		</if>
 		<if test="routeId != null and routeId !=''" >
-			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.route_id = ${routeId})
+			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.route_id = #{routeId})
 		</if>
 		) p
 		GROUP BY
@@ -532,16 +532,16 @@
 		LEFT JOIN p_plan_task pt  on pt.id = d.task_no
 		LEFT JOIN p_plan  pl on  pt.plan_id=pl.id
 		WHERE
-		    d.create_date &gt;= '${startDate}'
-		AND d.create_date &lt;= '${endDate}'
+		    d.create_date &gt;= '#{startDate}'
+		AND d.create_date &lt;= '#{endDate}'
 		<if test="orgCode != null and orgCode !=''" >
 			And (pl.org_code LIKE CONCAT( #{orgCode}, '-%' ) or pl.org_code= #{orgCode} )
 		</if>
 		<if test="planId != null and planId !=''" >
-			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.plan_id = ${planId})
+			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.plan_id = #{planId})
 		</if>
 		<if test="routeId != null and routeId !=''" >
-			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.route_id = ${routeId})
+			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.route_id = #{routeId})
 		</if>
 		) p
 		GROUP BY
@@ -812,13 +812,13 @@
 		<if test="orgCode != null and orgCode !=''" >
 			And (pt.org_code LIKE CONCAT( #{orgCode}, '-%' ) or pt.org_code= #{orgCode} )
 		</if>
-		AND d.create_date &gt;= '${startDate}'
-		AND d.create_date &lt;= '${endDate}'
+		AND d.create_date &gt;= '#{startDate}'
+		AND d.create_date &lt;= '#{endDate}'
 		<if test="planId != null and planId !=''" >
-			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.plan_id = ${planId})
+			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.plan_id = #{planId})
 		</if>
 		<if test="routeId != null and routeId !=''" >
-			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.route_id = ${routeId})
+			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.route_id = #{routeId})
 		</if>
 		) p
 		GROUP BY
@@ -1089,13 +1089,13 @@
 		<if test="orgCode != null and orgCode !=''" >
 			And (pp.org_code LIKE CONCAT( #{orgCode}, '-%' ) or pp.org_code= #{orgCode} )
 		</if>
-		AND d.create_date &gt;= '${startDate}'
-		AND d.create_date &lt;= '${endDate}'
+		AND d.create_date &gt;= '#{startDate}'
+		AND d.create_date &lt;= '#{endDate}'
 		<if test="planId != null and planId !=''" >
-			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.plan_id = ${planId})
+			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.plan_id = #{planId})
 		</if>
 		<if test="routeId != null and routeId !=''" >
-			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.route_id = ${routeId})
+			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.route_id = #{routeId})
 		</if>
 		) p
 		GROUP BY
@@ -1366,13 +1366,13 @@
 		<if test="orgCode != null and orgCode !=''" >
 			And pr.org_code= #{orgCode}
 		</if>
-		AND d.create_date &gt;= '${startDate}'
-		AND d.create_date &lt;= '${endDate}'
+		AND d.create_date &gt;= '#{startDate}'
+		AND d.create_date &lt;= '#{endDate}'
 		<if test="planId != null and planId !=''" >
-			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.plan_id = ${planId})
+			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.plan_id = #{planId})
 		</if>
 		<if test="routeId != null and routeId !=''" >
-			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.route_id = ${routeId})
+			and EXISTS(select 1 from p_plan_task pt where pt.id = d.task_no and pt.route_id = #{routeId})
 		</if>
 		) p
 		GROUP BY
@@ -1541,8 +1541,8 @@ FROM
 		FROM
 			p_plan_task pt
 		WHERE
-			pt.end_time BETWEEN '${startTime}'
-		AND '${endTime}'
+			pt.end_time BETWEEN '#{startTime}'
+		AND '#{endTime}'
 
 		<if test="summation == 'false'">
 			GROUP BY
@@ -1683,8 +1683,8 @@ FROM
         p_plan_task pt
         WHERE
          pt.user_id >0
-        AND pt.end_time BETWEEN '${startTime}'
-        AND '${endTime}'
+        AND pt.end_time BETWEEN '#{startTime}'
+        AND '#{endTime}'
 
         <if test="summation == 'false'">
             GROUP BY

amos-boot-system-patrol/src/main/resources/db/mapper/dbTemplate_check.xml

@@ -96,7 +96,7 @@
             <if test="catalogId!=null and catalogId!=''">and b.Catalog_Id = #{catalogId}</if>
             <if test="orgCode!=null and orgCode!=''">and (a.org_Code like concat (#{orgCode},"-%")or a.org_Code= #{orgCode})</if>
             <if test="pointId!=null and pointId!=''">and a.point_id = #{pointId}</if>
-            <if test="checkTime!=null and checkTime!=''">and TO_DAYS(a.check_time) = TO_DAYS('${checkTime}')</if>
+            <if test="checkTime!=null and checkTime!=''">and TO_DAYS(a.check_time) = TO_DAYS('#{checkTime}')</if>
             <if test="departmentId!=null and departmentId!='-1'"> and find_in_set(#{departmentId}, a.dep_id) > 0</if>
             <if test="checkType == '计划检查'">and a.plan_task_id &gt; 0</if>
             <if test="checkType == '无计划检查'">and a.plan_task_id &lt;= 0</if>
@@ -150,7 +150,7 @@
             <if test="catalogId!=null and catalogId!=''">and b.Catalog_Id = #{catalogId}</if>
             <if test="orgCode!=null and orgCode!=''">and (a.org_Code like concat (#{orgCode},"-%")or a.org_Code= #{orgCode})</if>
             <if test="pointId!=null and pointId!=''">and a.point_id = #{pointId}</if>
-            <if test="checkTime!=null and checkTime!=''">and TO_DAYS(a.check_time) = TO_DAYS('${checkTime}')</if>
+            <if test="checkTime!=null and checkTime!=''">and TO_DAYS(a.check_time) = TO_DAYS('#{checkTime}')</if>
             <if test="departmentId!=null and departmentId!='-1'"> and find_in_set(#{departmentId}, a.dep_id) > 0</if>
             <if test="checkType == '计划检查'">and a.plan_task_id &gt; 0</if>
             <if test="checkType == '无计划检查'">and a.plan_task_id &lt;= 0</if>
@@ -236,7 +236,7 @@
             <if test="catalogId!=null">and b.Catalog_Id = #{catalogId}</if>
             <if test="orgCode!=null">and (a.org_Code like concat (#{orgCode},"-%")or a.org_Code= #{orgCode})</if>
             <if test="pointId!=null">and a.point_id = #{pointId}</if>
-            <if test="checkTime!=null">and TO_DAYS(a.check_time) = TO_DAYS('${checkTime}')</if>
+            <if test="checkTime!=null">and TO_DAYS(a.check_time) = TO_DAYS('#{checkTime}')</if>
             <if test="departmentId!=null and departmentId!='-1'"> and find_in_set(#{departmentId}, a.dep_id) > 0</if>
             <if test="checkType == '计划检查'">and a.plan_task_id &gt; 0</if>
             <if test="checkType == '无计划检查'">and a.plan_task_id &lt;= 0</if>
@@ -254,7 +254,7 @@
                 and  d.biz_org_code LIKE CONCAT(#{bizOrgCode},'%')
             </if>
         </trim>
-        order by ${orderBy}
+        order by #{orderBy}
         <choose>
             <when test="pageSize==-1"></when>
             <when test="pageSize!=-1">limit #{offset},#{pageSize}</when>
@@ -404,7 +404,7 @@
             <if test="catalogId!=null and catalogId!=''">and b.Catalog_Id = #{catalogId}</if>
             <if test="orgCode!=null and orgCode!=''">and (a.org_Code like concat (#{orgCode},"-%")or a.org_Code= #{orgCode})</if>
             <if test="pointId!=null and pointId!=''">and a.point_id = #{pointId}</if>
-            <if test="checkTime!=null and checkTime!=''">and TO_DAYS(a.check_time) = TO_DAYS('${checkTime}')</if>
+            <if test="checkTime!=null and checkTime!=''">and TO_DAYS(a.check_time) = TO_DAYS('#{checkTime}')</if>
             <if test="departmentId!=null and departmentId!='-1'"> and find_in_set(#{departmentId}, a.dep_id) > 0</if>
             <if test="checkType == '计划检查'">and a.plan_task_id &gt; 0</if>
             <if test="checkType == '无计划检查'">and a.plan_task_id &lt;= 0</if>
@@ -425,7 +425,7 @@
             <if test="isExecute!=null and isExecute!='' and isExecute == '3'">and a.is_OK != #{isExecute}</if>
         </trim>
         order by
-            ${orderBy}
+            #{orderBy}
         <choose>
             <when test="pageSize==-1"></when>
             <when test="pageSize!=-1">limit #{offset}, #{pageSize}</when>
@@ -476,7 +476,7 @@
                 and a.org_code LIKE CONCAT(#{bizOrgCode},'%')
             </if>
         </trim>
-        order by ${orderBy}
+        order by #{orderBy}
         <choose>
             <when test="pageSize==-1"></when>
             <when test="pageSize!=-1">limit #{offset},#{pageSize}</when>

amos-boot-system-patrol/src/main/resources/db/mapper/dbTemplate_input_item.xml

@@ -436,7 +436,7 @@
 			and a.key_parts_type is not null
 		</if>
 		<if test="ids != null and ids != ''">
-			and a.id in (${ids})
+			and a.id in (#{ids})
 		</if>
 		<if test="treeId != null and treeId != '' and treeId == '-5'">
 			and a.custom_type is not null

amos-boot-system-patrol/src/main/resources/db/mapper/dbTemplate_plan_task.xml

@@ -237,7 +237,7 @@
 
 			) a
 		<include refid="plan-task-app-where"/>
-		<if test="orderBy != null and orderBy != ''"> order by ${orderBy} </if>
+		<if test="orderBy != null and orderBy != ''"> order by #{orderBy} </if>
 		limit #{offset},#{pageSize}
 	</select>
 	<select id="getPlanTasksCount" resultType="long">
@@ -856,10 +856,10 @@
 			ppc.id,
 			',|,',
 			ppc.id,
-			'$',
+			'#',
 			'|^',
 			ppc.id,
-			'$'
+			'#'
 			)
 		LEFT JOIN p_route_point_item prpi ON prpi.point_input_item_id = pii.id,
 		 (