java.sql.SQLException : sql injection violation, 注释不允许:选择

Question

如标题所示，我使用SQL选择但是报告错误。下面的Mapper中的SQL

<select id="selectBillDetailByBizIdAndClearType" resultMap="BaseResultMap">
    select
    <include refid="Base_Column_List" />
    from dwd_clearing_bill_detail
    where biz_detail_id in
    <foreach collection="bizDetailIdList" item="item" index="index" open="(" separator="," close=")">
      #{item}
    </foreach>
    and clear_type in
    <foreach collection="clearTypeList" item="item" index="index" open="(" separator="," close=")">
      #{item}
    </foreach>
  </select>

Answer 1

这是一个异常，表明以这种方式构建 SQL 语句是不安全的。有人可以注入(inject)恶意 SQL 代码、检索敏感数据或修改/删除您的数据。请参阅https://cheatsheetseries.owasp.org/cheatsheets/SQL_Injection_Prevention_Cheat_Sheet.html