sql 注入修复

fs-service/src/main/java/com/fs/company/service/impl/CompanyDeptServiceImpl.java

@@ -120,6 +120,10 @@ public class CompanyDeptServiceImpl implements ICompanyDeptService
         String updateBy = dept.getUpdateBy();
         dept = companyDeptMapper.selectCompanyDeptById(dept.getDeptId());
         dept.setUpdateBy(updateBy);
+        // 安全校验：ancestors 只能包含数字和逗号
+        if (dept.getAncestors() != null && !dept.getAncestors().matches("^[\\d,]+$")) {
+            throw new IllegalArgumentException("Invalid ancestors format");
+        }
         companyDeptMapper.updateDeptStatus(dept);
     }
 

fs-service/src/main/resources/mapper/company/CompanyDeptMapper.xml

@@ -164,6 +164,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             <if test="updateBy != null and updateBy != ''">update_by = #{updateBy},</if>
             update_time = sysdate()
         </set>
+        <!-- 安全说明：ancestors 来自 DB 内部字段(hierarchy path)，调用方 CompanyDeptServiceImpl 已做正则校验 ^[\d,]+$ -->
         where dept_id in (${ancestors})
     </update>
 

fs-service/src/main/resources/mapper/company/CompanyTagMapper.xml

@@ -54,7 +54,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         where ctu.user_id = #{userId}
     </select>
     <select id="findUserTagByUserId" resultType="java.lang.String">
-        select tag_ids from company_tag_user where user_id = ${userId} and company_user_id=${companyUserId} limit 1
+        select tag_ids from company_tag_user where user_id = #{userId} and company_user_id=#{companyUserId} limit 1
     </select>
     <resultMap id="companyTagMap" type="com.fs.company.domain.CompanyTag">
         <id column="tag_id" property="tagId" jdbcType="BIGINT" javaType="java.lang.Long"/>

fs-service/src/main/resources/mapper/company/CompanyUserMapper.xml

@@ -286,7 +286,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         </foreach>
     </insert>
     <update id="uploadQrCode">
-        update company_user set qr_code_weixin=#{url} where user_id=${userId}
+        update company_user set qr_code_weixin=#{url} where user_id=#{userId}
     </update>
     <update id="updateCompanyUser" parameterType="CompanyUser">
         update company_user
@@ -585,7 +585,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
                 AND company_user_id = #{companyUserId}
             </if>
             <if test="previousDay != null">
-                and camp_period_time = ${previousDay}
+                and camp_period_time = #{previousDay}
             </if>
         </where>
     </select>
@@ -597,7 +597,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
                 AND company_user_id = #{companyUserId}
             </if>
             <if test="previousDay != null">
-                and camp_period_time = ${previousDay}
+                and camp_period_time = #{previousDay}
             </if>
         </where>
     </select>
@@ -609,7 +609,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
                 AND company_user_id = #{companyUserId}
             </if>
             <if test="previousDay != null">
-                and camp_period_time = ${previousDay}
+                and camp_period_time = #{previousDay}
             </if>
         </where>
     </select>

fs-service/src/main/resources/mapper/course/FsCourseAnswerLogsMapper.xml

@@ -143,7 +143,8 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             </if>
         </where>
         ORDER BY cal_inner.log_id DESC
-        LIMIT ${(pageNum-1)*pageSize}, ${pageSize}
+        <bind name="limitOffset" value="(pageNum-1)*pageSize"/>
+        LIMIT #{limitOffset}, #{pageSize}
         ) AS paged_ids ON cal.log_id = paged_ids.log_id
         LEFT JOIN fs_user_course uc ON cal.course_id = uc.course_id
         ORDER BY

fs-service/src/main/resources/mapper/course/FsCourseRedPacketLogMapper.xml

@@ -244,7 +244,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         <if test="maps.companyIds != null and maps.companyIds.size() > 0  and maps.changeType == 1 ">
             AND l.company_id IN
             <foreach collection="maps.companyIds" open="(" close=")" separator="," item="item">
-                ${item}
+                #{item}
             </foreach>
         </if>
         <if test="maps.courseId != null ">
@@ -259,7 +259,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         <if test="maps.userIds != null and maps.userIds.size() > 0 and maps.changeType == 2 ">
           AND l.company_user_id IN
             <foreach collection="maps.userIds" open="(" close=")" separator="," item="item">
-                ${item}
+                #{item}
             </foreach>
         </if>
         GROUP BY

fs-service/src/main/resources/mapper/course/FsCourseTrafficLogMapper.xml

@@ -64,7 +64,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             create_time >= CURDATE()
             AND create_time < CURDATE() + INTERVAL 1 DAY
             <if test="companyId != null">
-                AND company_id = ${companyId}
+                AND company_id = #{companyId}
             </if>
         </where>
     </select>
@@ -77,7 +77,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             create_time  &gt;= CURDATE() - INTERVAL 1 DAY
             AND create_time &lt; CURDATE()
             <if test="companyId != null">
-                AND company_id = ${companyId}
+                AND company_id = #{companyId}
             </if>
         </where>
     </select>
@@ -92,7 +92,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             create_time >= DATE_FORMAT(CURDATE(), '%Y-%m-01')
             AND create_time &lt; DATE_FORMAT(CURDATE() + INTERVAL 1 MONTH, '%Y-%m-01')
             <if test="companyId != null">
-                AND company_id = ${companyId}
+                AND company_id = #{companyId}
             </if>
         </where>
     </select>
@@ -259,10 +259,10 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
                 and company_id = #{companyId}
             </if>
             <if test="courseId != null">
-                and course_id = ${courseId}
+                and course_id = #{courseId}
             </if>
             <if test="project != null">
-                and project = ${project}
+                and project = #{project}
             </if>
             <if test="common == null">
                 AND company_id IS not NULL

fs-service/src/main/resources/mapper/course/FsUserCourseTrainingCampMapper.xml

@@ -34,6 +34,7 @@
         </where>
         group by ctc.training_camp_id, ctc.training_camp_name, ctc.order_number
         order by
+        <!-- 安全说明：sc.column 和 sc.order 来自前端排序参数，当前该 SQL 无 Java 调用方。若后续启用，需在 Java 层对 column 做白名单校验 -->
         <choose>
             <when test="params.scs != null and params.scs.size() > 0">
                 <foreach collection="params.scs" item="sc" separator=",">

fs-service/src/main/resources/mapper/his/FsPackageOrderMapper.xml

@@ -318,7 +318,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         where O.is_pay = 1 ORDER BY RAND() desc LIMIT 20
     </select>
     <select id="selectOutTimeOrderList" resultType="com.fs.his.domain.FsPackageOrder">
-        select * from fs_package_order  where status = 1 AND NOW() &gt; DATE_ADD(create_time, INTERVAL ${unPayTime} MINUTE)
+        select * from fs_package_order  where status = 1 AND NOW() &gt; DATE_ADD(create_time, INTERVAL #{unPayTime} MINUTE)
     </select>
     <select id="selectInformationCollectionByStoreOrderId" resultType="com.fs.his.vo.FsUserInfoCollectionAndStoreOrderVo">
         SELECT ic.* FROM `fs_package_order` po

fs-service/src/main/resources/mapper/his/FsStoreOrderMapper.xml

@@ -953,8 +953,12 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             so.pay_money
         </if>
         <if test="maps.sortOrder != null and maps.sortOrder != ''">
-            ${maps.sortOrder}
-        </if>
+        <choose>
+            <when test='maps.sortOrder == "desc"'>desc</when>
+            <when test='maps.sortOrder == "asc"'>asc</when>
+            <otherwise>desc</otherwise>
+        </choose>
+    </if>
         <if test="maps.sortField == null or maps.sortField == ''">
             so.order_id desc
         </if>
@@ -1177,8 +1181,12 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             so.pay_money
         </if>
         <if test="maps.sortOrder != null and maps.sortOrder != ''">
-            ${maps.sortOrder}
-        </if>
+        <choose>
+            <when test='maps.sortOrder == "desc"'>desc</when>
+            <when test='maps.sortOrder == "asc"'>asc</when>
+            <otherwise>desc</otherwise>
+        </choose>
+    </if>
         <if test="maps.sortField == null or maps.sortField == ''">
             so.order_id desc
         </if>
@@ -1656,8 +1664,12 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             so.pay_money
         </if>
         <if test="maps.sortOrder != null and maps.sortOrder != ''">
-            ${maps.sortOrder}
-        </if>
+        <choose>
+            <when test='maps.sortOrder == "desc"'>desc</when>
+            <when test='maps.sortOrder == "asc"'>asc</when>
+            <otherwise>desc</otherwise>
+        </choose>
+    </if>
         <if test="maps.sortField == null or maps.sortField == ''">
             so.order_id desc
         </if>
@@ -2153,7 +2165,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
     </select>
     <select id="selectOutTimeOrderList" resultType="com.fs.his.domain.FsStoreOrder">
         <include refid="selectFsStoreOrderVo"/>
-        where is_del = 0 and status = 1 and NOW() &gt; DATE_ADD(create_time, INTERVAL ${unPayTime} MINUTE)
+        where is_del = 0 and status = 1 and NOW() &gt; DATE_ADD(create_time, INTERVAL #{unPayTime} MINUTE)
     </select>
 
 </mapper>

fs-service/src/main/resources/mapper/his/FsUserMapper.xml

@@ -402,7 +402,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             <if test="companyUserIds != null and companyUserIds.size > 0">
                 AND ucu.company_user_id in
                 <foreach collection="companyUserIds" item="item" index="index" open="(" separator="," close=")">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="nickname != null and nickname != ''">
@@ -418,7 +418,8 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
                 AND fs_user.create_time &gt;= #{sTime} AND fs_user.create_time &lt;= #{eTime}
             </if>
         </where>
-        limit ${(pageNum-1)*pageSize},${pageSize}
+        <bind name="limitOffset" value="(pageNum-1)*pageSize"/>
+        limit #{limitOffset},#{pageSize}
     </select>
 
     <select id="selectFsUserPageListCount" resultType="java.lang.Long">
@@ -444,7 +445,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             <if test="companyUserIds != null and companyUserIds.size > 0">
                 AND ucu.company_user_id in
                 <foreach collection="companyUserIds" item="item" index="index" open="(" separator="," close=")">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="nickname != null and nickname!=''">
@@ -464,7 +465,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         where
         user_id in
         <foreach collection="userIds" open="(" close=")" separator="," item="item">
-            ${item}
+            #{item}
         </foreach>
     </update>
 

fs-service/src/main/resources/mapper/hisStore/FsStoreOrderScrmMapper.xml

@@ -1250,8 +1250,12 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             o.pay_money
         </if>
         <if test="maps.sortOrder != null and maps.sortOrder != ''">
-            ${maps.sortOrder}
-        </if>
+        <choose>
+            <when test='maps.sortOrder == "desc"'>desc</when>
+            <when test='maps.sortOrder == "asc"'>asc</when>
+            <otherwise>desc</otherwise>
+        </choose>
+    </if>
         <if test="maps.sortField == null or maps.sortField == ''">
             o.id desc
         </if>
@@ -1909,8 +1913,12 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             o.pay_money
         </if>
         <if test="maps.sortOrder != null and maps.sortOrder != ''">
-            ${maps.sortOrder}
-        </if>
+        <choose>
+            <when test='maps.sortOrder == "desc"'>desc</when>
+            <when test='maps.sortOrder == "asc"'>asc</when>
+            <otherwise>desc</otherwise>
+        </choose>
+    </if>
         <if test="maps.sortField == null or maps.sortField == ''">
             o.id desc
         </if>

fs-service/src/main/resources/mapper/hisStore/FsUserCourseCountScrmMapper.xml

@@ -63,7 +63,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             ifnull ( sum( fs_user_course_count.part_course_count ), 0 ) AS part_course_count,
             Max( fs_user_course_count.last_watch_date ) AS last_watch_date,
             Max( fs_user_course_count.complete_watch_date) AS complete_watch_date
-            from fs_user_course_count where user_id = ${userId}
+            from fs_user_course_count where user_id = #{userId}
     </select>
 
     <insert id="insertFsUserCourseCount" parameterType="FsUserCourseCountScrm">

fs-service/src/main/resources/mapper/hisStore/FsUserScrmMapper.xml

@@ -202,7 +202,8 @@
             </if>
         </where>
         order by u.user_id desc
-        limit ${(pageNum-1)*pageSize},${pageSize}
+        <bind name="limitOffset" value="(pageNum-1)*pageSize"/>
+        limit #{limitOffset},#{pageSize}
         ) t on t.user_id = `user`.user_id
         left join company_user cu on cu.user_id = t.companyUserId
     </select>
@@ -577,7 +578,7 @@
         where
             user_id in
         <foreach collection="userIds" open="(" close=")" separator="," item="item">
-            ${item}
+            #{item}
         </foreach>
     </update>
 
@@ -628,7 +629,7 @@
             <if test="companyUserIds != null and companyUserIds.size > 0">
                 AND ucu.company_user_id in
                 <foreach collection="companyUserIds" item="item" index="index" open="(" separator="," close=")">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="nickname != null and nickname != ''">
@@ -640,7 +641,8 @@
             <if test="projectId != null">
                 AND ucu.project_id = #{projectId}
             </if>
-        limit ${(pageNum-1)*pageSize},${pageSize}
+        <bind name="limitOffset" value="(pageNum-1)*pageSize"/>
+        limit #{limitOffset},#{pageSize}
     </select>
 
     <select id="selectFsUserPageList" resultType="com.fs.store.vo.h5.FsUserPageListVO">
@@ -1695,7 +1697,7 @@
             <if test="companyUserIds != null and companyUserIds.size > 0">
                 AND ucu.company_user_id in
                 <foreach collection="companyUserIds" item="item" index="index" open="(" separator="," close=")">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="nickname != null and nickname!=''">

fs-service/src/main/resources/mapper/live/LiveDataMapper.xml

@@ -230,7 +230,11 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
                 END AS date_range,
         <choose>
             <when test="category == 'streams'"> COUNT(l.live_id) </when>
-            <otherwise> SUM(ld.${category}) </otherwise>
+            <when test="category == 'page_views'"> SUM(ld.page_views) </when>
+            <when test="category == 'unique_visitors'"> SUM(ld.unique_visitors) </when>
+            <when test="category == 'total_views'"> SUM(ld.total_views) </when>
+            <when test="category == 'unique_viewers'"> SUM(ld.unique_viewers) </when>
+            <otherwise> SUM(ld.page_views) </otherwise>
         </choose>
          AS views
             FROM live_data ld
@@ -280,7 +284,11 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
                 END AS date_range,
         <choose>
             <when test="category == 'streams'"> COUNT(l.live_id) </when>
-            <otherwise> SUM(ld.${category}) </otherwise>
+            <when test="category == 'page_views'"> SUM(ld.page_views) </when>
+            <when test="category == 'unique_visitors'"> SUM(ld.unique_visitors) </when>
+            <when test="category == 'total_views'"> SUM(ld.total_views) </when>
+            <when test="category == 'unique_viewers'"> SUM(ld.unique_viewers) </when>
+            <otherwise> SUM(ld.page_views) </otherwise>
         </choose>
          AS views
             FROM live_data ld

fs-service/src/main/resources/mapper/live/LiveOrderMapper.xml

@@ -822,7 +822,11 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         o.pay_money
     </if>
     <if test="maps.sortOrder != null and maps.sortOrder != ''">
-        ${maps.sortOrder}
+        <choose>
+            <when test='maps.sortOrder == "desc"'>desc</when>
+            <when test='maps.sortOrder == "asc"'>asc</when>
+            <otherwise>desc</otherwise>
+        </choose>
     </if>
     <if test="maps.sortField == null or maps.sortField == ''">
         o.order_id desc

fs-service/src/main/resources/mapper/qw/HyWorkTaskMapper.xml

@@ -60,7 +60,8 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             <if test="companyUserId != null "> and t_inner.company_user_id = #{companyUserId}</if>
         </where>
         ORDER BY t_inner.score DESC, t_inner.id DESC
-        LIMIT ${(pageNum-1)*pageSize}, ${pageSize}
+        <bind name="limitOffset" value="(pageNum-1)*pageSize"/>
+        LIMIT #{limitOffset}, #{pageSize}
         ) AS filtered_ids ON t.id = filtered_ids.id
         ORDER BY t.score DESC, t.id DESC
     </select>

fs-service/src/main/resources/mapper/qw/QwWatchLogMapper.xml

@@ -107,7 +107,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             <if test="companyUserIds != null and companyUserIds.size() != 0">
                 and company_user_id in
                 <foreach collection="companyUserIds" item="item" open="(" close=")" separator=",">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="project != null">
@@ -131,7 +131,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             <if test="companyUserIds != null">
                 and company_user_id in
                 <foreach collection="companyUserIds" item="item" open="(" close=")" separator=",">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="project != null">
@@ -160,7 +160,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             <if test="companyUserIds != null and companyUserIds.size() != 0">
                 and company_user_id in
                 <foreach collection="companyUserIds" item="item" open="(" close=")" separator=",">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="project != null">
@@ -175,7 +175,8 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             and DATE(line_time) between #{sTime} and #{dTime}
         </where>
         group by project,course_id,video_id
-        limit ${(pageNum-1)*pageSize},${pageSize}
+        <bind name="limitOffset" value="(pageNum-1)*pageSize"/>
+        limit #{limitOffset},#{pageSize}
     </select>
     <select id="selectQwWatchLogByCompanyUserIdCount" resultType="java.lang.Long">
         SELECT COUNT(*)

fs-service/src/main/resources/mapper/sop/QwSopMapper.xml

@@ -490,7 +490,7 @@
             ]]>
             </if>
             <if test="companyId != null">
-                AND qw_sop.company_id = ${companyId}
+                AND qw_sop.company_id = #{companyId}
             </if>
         </where>
         ORDER BY qw_sop.create_time DESC

fs-service/src/main/resources/mapper/statis/ConsumptionBalanceMapper.xml

@@ -42,7 +42,7 @@
         select count(log_id) from fs_course_watch_log
         <where>
             <if test="userType != null">
-                and send_type=${userType}
+                and send_type=#{userType}
             </if>
             <if test="startTime != null and endTime != null">
                 and create_time between #{startTime} and #{endTime}
@@ -57,7 +57,7 @@
         <where>
             finish_time is not null
             <if test="userType != null">
-                and send_type=${userType}
+                and send_type=#{userType}
             </if>
             <if test="startTime != null and endTime != null">
                 and create_time between #{startTime} and #{endTime}
@@ -71,7 +71,7 @@
         select count(distinct user_id) from fs_course_watch_log
         <where>
             <if test="userType != null">
-                and send_type=${userType}
+                and send_type=#{userType}
             </if>
             <if test="startTime != null and endTime != null">
                 and create_time between #{startTime} and #{endTime}
@@ -90,7 +90,7 @@
                  AND create_time BETWEEN #{startTime} AND #{endTime}
              </if>
              <if test="userType != null">
-                 and send_type=${userType}
+                 and send_type=#{userType}
              </if>
              <if test="companyId != null">
                  and company_id = #{companyId}
@@ -129,7 +129,7 @@
                 and rpl.create_time BETWEEN #{startTime} AND #{endTime}
             </if>
             <if test="userType != null">
-                and log.send_type = ${userType}
+                and log.send_type = #{userType}
             </if>
             <if test="companyId != null">
                 and log.company_id = #{companyId}
@@ -145,7 +145,7 @@
                 and rpl.create_time BETWEEN #{startTime} AND #{endTime}
             </if>
             <if test="userType != null">
-                and log.send_type = ${userType}
+                and log.send_type = #{userType}
             </if>
             <if test="companyId != null">
                 and log.company_id = #{companyId}
@@ -190,7 +190,7 @@
                 AND create_time <![CDATA[<]]> #{endTime}
             </if>
             <if test="userType != null">
-                AND send_type = ${userType}
+                AND send_type = #{userType}
             </if>
         </where>
         GROUP BY
@@ -220,10 +220,10 @@
                 AND create_time <![CDATA[<]]> #{endTime}
             </if>
             <if test="userType != null">
-                AND send_type = ${userType}
+                AND send_type = #{userType}
             </if>
             <if test="companyId != null">
-                AND company_id = ${companyId}
+                AND company_id = #{companyId}
             </if>
         </where>
         GROUP BY company_id
@@ -248,7 +248,7 @@
 <!--                AND w.create_time <![CDATA[<]]> #{endTime}-->
 <!--            </if>-->
 <!--            <if test="userType != null">-->
-<!--                AND send_type = ${userType}-->
+<!--                AND send_type = #{userType}-->
 <!--            </if>-->
 <!--            <if test="companyId != null">-->
 <!--                AND w.company_id = ${companyId}-->
@@ -423,10 +423,10 @@
                 AND rpl.create_time <![CDATA[<]]> #{endTime}
             </if>
             <if test="userType != null">
-                and log.send_type = ${userType}
+                and log.send_type = #{userType}
             </if>
             <if test="companyId != null">
-                and log.company_id = ${companyId}
+                and log.company_id = #{companyId}
             </if>
         </where>
         GROUP BY
@@ -462,10 +462,10 @@
                 AND rpl.create_time <![CDATA[<]]> #{endTime}
             </if>
             <if test="userType != null">
-                and log.send_type = ${userType}
+                and log.send_type = #{userType}
             </if>
             <if test="companyId != null">
-                and log.company_id = ${companyId}
+                and log.company_id = #{companyId}
             </if>
         </where>
         group by start_date
@@ -509,7 +509,7 @@
                 (select COUNT(*) FROM qw_user
                 <where>
                     <if test="companyId != null">
-                       AND company_id = ${companyId}
+                       AND company_id = #{companyId}
                     </if>
                 </where>
         ) AS qw_member_num

fs-service/src/main/resources/mapper/statis/FsStatisEveryDayMapper.xml

@@ -144,13 +144,13 @@
             <if test="userIds != null and userIds.length > 0">
                 AND company_user_id IN
                 <foreach collection="userIds" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="periodList != null and periodList.length > 0">
                 AND period_id IN
                 <foreach collection="periodList" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="startDate != null and endDate != null">

fs-service/src/main/resources/mapper/statis/FsStatisPeriodWatchMapper.xml

@@ -42,13 +42,13 @@
             <if test="userIds != null and userIds.length > 0">
                 AND company_user_id IN
                 <foreach collection="userIds" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="periodList != null and periodList.length > 0">
                 AND period_id IN
                 <foreach collection="periodList" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="startDate != null and endDate != null">

fs-service/src/main/resources/mapper/statis/FsStatisSalerWatchMapper.xml

@@ -59,7 +59,7 @@
             <if test="userIds != null and userIds.size() > 0">
                 AND company_user_id IN
                 <foreach collection="userIds" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="periodList != null and periodList.size() > 0">
@@ -117,7 +117,7 @@
             <if test="userIds != null and userIds.size() > 0">
                 AND company_user_id IN
                 <foreach collection="userIds" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="periodList != null and periodList.size() > 0">
@@ -166,7 +166,7 @@
             <if test="userIds != null and userIds.size() > 0">
                 AND company_user_id IN
                 <foreach collection="userIds" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="periodList != null and periodList.size() > 0">
@@ -226,7 +226,7 @@
             <if test="userIds != null and userIds.size() > 0">
                 AND watch.company_user_id IN
                 <foreach collection="userIds" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="periodList != null and periodList.size() > 0">
@@ -353,7 +353,7 @@
             <if test="userIds != null and userIds.size() > 0">
                 AND company_user_id IN
                 <foreach collection="userIds" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="periodList != null and periodList.size() > 0">
@@ -402,7 +402,7 @@
             <if test="userIds != null and userIds.size() > 0">
                 AND company_user_id IN
                 <foreach collection="userIds" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="periodList != null and periodList.size() > 0">

fs-service/src/main/resources/mapper/store/FsUserCourseCountMapper.xml

@@ -63,7 +63,7 @@
             ifnull ( sum( fs_user_course_count.part_course_count ), 0 ) AS part_course_count,
             Max( fs_user_course_count.last_watch_date ) AS last_watch_date,
             Max( fs_user_course_count.complete_watch_date) AS complete_watch_date
-        from fs_user_course_count where user_id = ${userId}
+        from fs_user_course_count where user_id = #{userId}
     </select>
 
     <insert id="insertFsUserCourseCount" parameterType="FsUserCourseCount">