Closed
Description
Affects: 6.1.2
When the table name contains the '&' character, the table name after '&' will be recognized as a parameter.
Example:
@Test
void test() {
NamedParameterJdbcTemplate ops = new NamedParameterJdbcTemplate(new JdbcTemplate());
SqlParameterSource sqlParameterSource = new MapSqlParameterSource("id", 1);
ops.query("select * from `tb&user` where id = :id", sqlParameterSource, new ColumnMapRowMapper());
}
The result of running the code is:
org.springframework.dao.InvalidDataAccessApiUsageException: No value supplied for the SQL parameter 'user`': No value registered for key 'user`'
at org.springframework.jdbc.core.namedparam.NamedParameterUtils.buildValueArray(NamedParameterUtils.java:379)
at org.springframework.jdbc.core.namedparam.NamedParameterJdbcTemplate.getPreparedStatementCreator(NamedParameterJdbcTemplate.java:472)
at org.springframework.jdbc.core.namedparam.NamedParameterJdbcTemplate.getPreparedStatementCreator(NamedParameterJdbcTemplate.java:446)
at org.springframework.jdbc.core.namedparam.NamedParameterJdbcTemplate.query(NamedParameterJdbcTemplate.java:218)
at org.example.demo.jdbc.NamedParameterJdbcTemplateTest.test(NamedParameterJdbcTemplateTest.java:20)
at java.base/java.lang.reflect.Method.invoke(Method.java:580)
at java.base/java.util.ArrayList.forEach(ArrayList.java:1596)
at java.base/java.util.ArrayList.forEach(ArrayList.java:1596)