人事管理系统6
模糊查询
DepartmentMapper.xml ：
<select id="findDepartmentListByName" resultMap="BaseResultMap">
select
<include refid="Base_Column_List"/>
from department
where dname like '%${dname}%' /*where dname like concat('%',#
{dname},'%')*/
order by establishmentdate desc
limit #{start},#{limit}
</select>
<!--#会把传入的String类型自动加上引号，其他数据类型不会加引号，此处会变成'%'开发部'%'，语法错
误-->
<!--$把传入的数据直接显示在sql语句中，不会添加引号，此处会变成'%开发部%'-->
<select id="getTotalDepartmentsByName" resultType="int">
select count(*) from department where dname like '%${dname}%'
</select> ${} ：不安全
直接拼接 SQL ，容易被 SQL 注入攻击利用。
select * from user where username = '${username}'
若用户输入 admin' or '1'='1 会直接执行
select * from user where username='admin' or '1'='1'
${} 是拼接符
#{} ：安全
通过预编译方式传参，防止 SQL 注入
select * from user where username = #{username}
#{} 是占位符
DepartmentMapper.java ：
List<Department> findDepartmentListByName(@Param("dname") String
dname,@Param("start") int start,@Param("limit") int limit);
int getTotalDepartmentsByName(@Param("dname") String dname); DepartmentService.java ：
Result getDepartmentsListByName(String dname, int start, int limit); DepartmentServiceImpl.java ：
@Override
public Result getDepartmentsListByName(String dname, int start, int limit) {
List<Department> departmentList =
departmentMapper.findDepartmentListByName(dname, start, limit);
int totalDepartments = departmentMapper.getTotalDepartmentsByName(dname);
Result result = new Result();
result.setCode(0);
result.setMsg("查找成功！");
result.setCount(totalDepartments);
result.setData(departmentList);
return result;
} DepartmentController.java ：
@GetMapping("/department/listbyname")
@ResponseBody
public Result listByName(@RequestParam Map<String, Object> params) {
int page = Integer.parseInt(params.get("page").toString());
int limit = Integer.parseInt(params.get("limit").toString());
int start = (page - 1) * limit;
String dname = params.get("dname").toString();
return departmentService.getDepartmentsListByName(dname, start, limit);
}刷新页面：
AuserController.java ：
@GetMapping("/reload")
@ResponseBody
public boolean reload(HttpSession session) {
String name = session.getAttribute("name").toString();
return name != null;
}增
为保证部门名称不重复，对 dname 字段设置唯一性约束：
DepartmentController.java ：
@GetMapping("/department/add")
public String gotoDepartmentAdd() {
return "admin/department-add";
} 修改 DepartmentMapper.java 中已自动生成方法的返回类型：
boolean insertSelective(Department record); DepartmentService.java ：
Result addDepartment(Department department); DepartmentServiceImpl.java ：
@Override
public Result addDepartment(Department department) {
Result result = new Result();
if(departmentMapper.insertSelective(department)){
result.setCode(0);
result.setMsg("新建成功！");
}else{
result.setCode(1);
result.setMsg("新建失败！");
}
return result;
} DepartmentController.java ：
@PostMapping("/department/add")
@ResponseBody
public Result addDepartment(@RequestParam("dname") String dname,
@RequestParam("dtel") String dtel, @RequestParam("description") String
description) {
Department department = new Department();
department.setDname(dname);
department.setDtel(dtel);
department.setDescription(description);
department.setEstablishmentdate(new Date());
return departmentService.addDepartment(department);
} 或通过 @RequestParam 获取 Map 键值对传参：
@PostMapping("/department/add")
@ResponseBody
public Result addDepartment(@RequestParam Map<String, Object> map) {
Department department = new Department();
department.setDname(map.get("dname").toString());
department.setDtel(map.get("dtel").toString());
department.setDescription(map.get("description").toString());
department.setEstablishmentdate(new Date());
return departmentService.addDepartment(department);
} 或通过 @RequestBody 获取 Map 键值对传参，但需要修改 department-add.html 的数据提交格式为 json 格式：
@PostMapping("/department/add")
@ResponseBody
public Result addDepartment(@RequestBody Map<String, Object> map) {
Department department = new Department();
department.setDname(map.get("dname").toString());
department.setDtel(map.get("dtel").toString());
department.setDescription(map.get("description").toString());
department.setEstablishmentdate(new Date());
return departmentService.addDepartment(department);
} department-add.html 中的
data: data.field, 替换为
data: JSON.stringify(data.field),
contentType : "application/json",