Merge remote-tracking branch 'origin/saas-api' into saas-api

fs-admin-saas/src/main/java/com/fs/company/controller/company/FsRedPacketController.java

@@ -1,45 +0,0 @@
-package com.fs.company.controller.company;
-
-import com.fs.common.core.controller.BaseController;
-import com.fs.common.core.domain.R;
-import com.fs.common.utils.ServletUtils;
-import com.fs.company.domain.Company;
-import com.fs.framework.security.LoginUser;
-import com.fs.framework.service.TokenService;
-import com.fs.his.domain.FsRedPacket;
-import com.fs.his.service.IFsRedPacketService;
-import org.springframework.beans.factory.annotation.Autowired;
-import org.springframework.web.bind.annotation.GetMapping;
-import org.springframework.web.bind.annotation.RequestMapping;
-import org.springframework.web.bind.annotation.RestController;
-import org.springframework.context.annotation.Profile;
-
-/**
- * @description: 红包信息
- * @author: Xgb
- * @createDate: 2025/11/4
- * @version: 1.0
- */
-@Profile("company")
-@RestController
-@RequestMapping("/his/redPacket")
-public class FsRedPacketController extends BaseController {
-
-    @Autowired
-    private IFsRedPacketService fsRedPacketService;
-
-    @Autowired
-    private TokenService tokenService;
-
-    @GetMapping("/info")
-    public R info() {
-        com.fs.framework.security.LoginUser loginUser = (com.fs.framework.security.LoginUser) tokenService.getLoginUser(ServletUtils.getRequest());
-
-        Company company = loginUser.getCompany();
-        FsRedPacket redPacket=fsRedPacketService.getInfo(company.getCompanyId());
-        return  R.ok().put("data",redPacket);
-    }
-
-
-
-}

fs-admin-saas/src/main/java/com/fs/his/controller/FsRedPacketController.java

@@ -0,0 +1,56 @@
+package com.fs.his.controller;
+
+import com.fs.common.core.controller.BaseController;
+import com.fs.common.core.domain.R;
+import com.fs.common.core.redis.RedisCache;
+import com.fs.company.domain.Company;
+import com.fs.company.service.ICompanyService;
+import com.fs.his.domain.FsRedPacket;
+import com.fs.his.service.IFsRedPacketService;
+import org.springframework.beans.factory.annotation.Autowired;
+import org.springframework.context.annotation.Profile;
+import org.springframework.web.bind.annotation.GetMapping;
+import org.springframework.web.bind.annotation.RequestMapping;
+import org.springframework.web.bind.annotation.RestController;
+
+import java.math.BigDecimal;
+import java.util.List;
+
+/**
+ * @description: 红包信息
+ * @author: Xgb
+ * @createDate: 2025/11/4
+ * @version: 1.0
+ */
+@RestController
+@RequestMapping("/his/redPacket")
+public class FsRedPacketController extends BaseController {
+
+    @Autowired
+    private IFsRedPacketService fsRedPacketService;
+
+    @Autowired
+    private ICompanyService companyService;
+
+    @GetMapping("/info")
+    public R info() {
+        FsRedPacket result;
+
+        result = new FsRedPacket();
+        BigDecimal totalBalance = BigDecimal.ZERO;
+        BigDecimal totalTodayConsumption = BigDecimal.ZERO;
+        List<Company> companies = companyService.selectCompanyList(new Company());
+        for (Company c : companies) {
+            FsRedPacket info = fsRedPacketService.getInfo(c.getCompanyId());
+            if (info.getRedBalance() != null) {
+                totalBalance = totalBalance.add(info.getRedBalance());
+            }
+            if (info.getRedTodayComsumption() != null) {
+                totalTodayConsumption = totalTodayConsumption.add(info.getRedTodayComsumption());
+            }
+        }
+        result.setRedBalance(totalBalance);
+        result.setRedTodayComsumption(totalTodayConsumption);
+        return R.ok().put("data", result);
+    }
+}

fs-admin-saas/src/main/java/com/fs/hisStore/task/LiveTask.java

@@ -5,6 +5,7 @@ import cn.hutool.json.JSONUtil;
 import com.fs.common.core.domain.R;
 import com.fs.common.core.redis.RedisCache;
 import com.fs.common.utils.DateUtils;
+import com.fs.common.utils.sql.SqlUtil;
 import com.fs.company.service.ICompanyService;
 import com.fs.company.vo.RedPacketMoneyVO;
 import com.fs.course.mapper.FsCourseRedPacketLogMapper;
@@ -593,6 +594,11 @@ public class LiveTask {
                 });
 
         tablesToCheck.forEach(dto -> {
+            // 校验SQL标识符安全
+            SqlUtil.validateIdentifier(dto.getTableName());
+            SqlUtil.validateIdentifier(dto.getUserColumn());
+            SqlUtil.validateIdentifier(dto.getPhoneColumn());
+            SqlUtil.validateIdentifier(dto.getDateColumn());
             //获取证件失效日期字段小于当前时间加提前天数的用户和电话号码
             String sql = String.format("SELECT %s , %s " +
                             "FROM %s " +
@@ -634,6 +640,10 @@ public class LiveTask {
                         .build());
 
         toDisable.forEach(dto -> {
+            // 校验SQL标识符安全
+            SqlUtil.validateIdentifier(dto.getTableName());
+            SqlUtil.validateIdentifier(dto.getDateColumn());
+            SqlUtil.validateIdentifier(dto.getStatusColumn());
             //更新证件失效日期字段小于当前时间的数据
             String sql = String.format("UPDATE %s " +
                             "SET %s = %s " +

fs-admin-saas/src/main/java/com/fs/hisStore/task/MallStoreTask.java

@@ -6,6 +6,7 @@ import cn.hutool.json.JSONUtil;
 import com.fs.common.core.domain.R;
 import com.fs.common.core.redis.RedisCache;
 import com.fs.common.utils.DateUtils;
+import com.fs.common.utils.sql.SqlUtil;
 import com.fs.company.service.ICompanyService;
 import com.fs.company.vo.RedPacketMoneyVO;
 import com.fs.course.mapper.FsCourseRedPacketLogMapper;
@@ -637,6 +638,11 @@ public class MallStoreTask
                 });
 
         tablesToCheck.forEach(dto -> {
+            // 校验SQL标识符安全
+            SqlUtil.validateIdentifier(dto.getTableName());
+            SqlUtil.validateIdentifier(dto.getUserColumn());
+            SqlUtil.validateIdentifier(dto.getPhoneColumn());
+            SqlUtil.validateIdentifier(dto.getDateColumn());
             //获取证件失效日期字段小于当前时间加提前天数的用户和电话号码
             String sql = String.format("SELECT %s , %s " +
                             "FROM %s " +
@@ -679,6 +685,10 @@ public class MallStoreTask
                                 .build());
 
         toDisable.forEach(dto -> {
+            // 校验SQL标识符安全
+            SqlUtil.validateIdentifier(dto.getTableName());
+            SqlUtil.validateIdentifier(dto.getDateColumn());
+            SqlUtil.validateIdentifier(dto.getStatusColumn());
             //更新证件失效日期字段小于当前时间的数据
             String sql = String.format("UPDATE %s " +
                     "SET %s = %s " +

fs-common/src/main/java/com/fs/common/utils/sql/SqlUtil.java

@@ -5,8 +5,7 @@ import com.fs.common.utils.StringUtils;
 
 /**
  * sql操作工具类
- * 
-
+ *
  */
 public class SqlUtil
 {
@@ -15,6 +14,11 @@ public class SqlUtil
      */
     public static String SQL_PATTERN = "[a-zA-Z0-9_\\ \\,\\.]+";
 
+    /**
+     * SQL标识符模式：仅允许字母、数字、下划线（表名、列名）
+     */
+    public static String SQL_IDENTIFIER_PATTERN = "[a-zA-Z0-9_]+";
+
     /**
      * 检查字符，防止注入绕过
      */
@@ -34,4 +38,32 @@ public class SqlUtil
     {
         return value.matches(SQL_PATTERN);
     }
+
+    /**
+     * 验证SQL标识符（表名、列名）是否安全，仅允许字母、数字、下划线
+     * @param identifier SQL标识符
+     * @return 是否安全
+     */
+    public static boolean isValidIdentifier(String identifier)
+    {
+        if (StringUtils.isEmpty(identifier))
+        {
+            return false;
+        }
+        return identifier.matches(SQL_IDENTIFIER_PATTERN);
+    }
+
+    /**
+     * 校验SQL标识符，不安全则抛异常
+     * @param identifier SQL标识符
+     * @return 校验通过的标识符
+     */
+    public static String validateIdentifier(String identifier)
+    {
+        if (!isValidIdentifier(identifier))
+        {
+            throw new UtilException("SQL标识符不合法: " + identifier);
+        }
+        return identifier;
+    }
 }

fs-service/src/main/resources/mapper/company/CompanyDeptMapper.xml

@@ -164,7 +164,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             <if test="updateBy != null and updateBy != ''">update_by = #{updateBy},</if>
             update_time = sysdate()
         </set>
-        where dept_id in (${ancestors})
+        where find_in_set(dept_id, #{ancestors})
     </update>
 
     <select id="selectChildrenDeptById" resultMap="CompanyDeptResult">

fs-service/src/main/resources/mapper/company/CompanyTagMapper.xml

@@ -54,7 +54,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         where ctu.user_id = #{userId}
     </select>
     <select id="findUserTagByUserId" resultType="java.lang.String">
-        select tag_ids from company_tag_user where user_id = ${userId} and company_user_id=${companyUserId} limit 1
+        select tag_ids from company_tag_user where user_id = #{userId} and company_user_id=#{companyUserId} limit 1
     </select>
     <resultMap id="companyTagMap" type="com.fs.company.domain.CompanyTag">
         <id column="tag_id" property="tagId" jdbcType="BIGINT" javaType="java.lang.Long"/>

fs-service/src/main/resources/mapper/company/CompanyUserMapper.xml

@@ -288,7 +288,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         </foreach>
     </insert>
     <update id="uploadQrCode">
-        update company_user set qr_code_weixin=#{url} where user_id=${userId}
+        update company_user set qr_code_weixin=#{url} where user_id=#{userId}
     </update>
     <update id="updateCompanyUser">
         update company_user
@@ -587,7 +587,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
                 AND company_user_id = #{companyUserId}
             </if>
             <if test="previousDay != null">
-                and camp_period_time = ${previousDay}
+                and camp_period_time = #{previousDay}
             </if>
         </where>
     </select>
@@ -599,7 +599,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
                 AND company_user_id = #{companyUserId}
             </if>
             <if test="previousDay != null">
-                and camp_period_time = ${previousDay}
+                and camp_period_time = #{previousDay}
             </if>
         </where>
     </select>
@@ -611,7 +611,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
                 AND company_user_id = #{companyUserId}
             </if>
             <if test="previousDay != null">
-                and camp_period_time = ${previousDay}
+                and camp_period_time = #{previousDay}
             </if>
         </where>
     </select>

fs-service/src/main/resources/mapper/course/FsCourseAnswerLogsMapper.xml

@@ -143,7 +143,8 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             </if>
         </where>
         ORDER BY cal_inner.log_id DESC
-        LIMIT ${(pageNum-1)*pageSize}, ${pageSize}
+        <bind name="offset" value="(pageNum-1)*pageSize" />
+        LIMIT #{offset}, #{pageSize}
         ) AS paged_ids ON cal.log_id = paged_ids.log_id
         LEFT JOIN fs_user_course uc ON cal.course_id = uc.course_id
         ORDER BY

fs-service/src/main/resources/mapper/course/FsCourseTrafficLogMapper.xml

@@ -64,7 +64,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             create_time >= CURDATE()
             AND create_time < CURDATE() + INTERVAL 1 DAY
             <if test="companyId != null">
-                AND company_id = ${companyId}
+                AND company_id = #{companyId}
             </if>
         </where>
     </select>
@@ -77,7 +77,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             create_time  &gt;= CURDATE() - INTERVAL 1 DAY
             AND create_time &lt; CURDATE()
             <if test="companyId != null">
-                AND company_id = ${companyId}
+                AND company_id = #{companyId}
             </if>
         </where>
     </select>
@@ -92,7 +92,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             create_time >= DATE_FORMAT(CURDATE(), '%Y-%m-01')
             AND create_time &lt; DATE_FORMAT(CURDATE() + INTERVAL 1 MONTH, '%Y-%m-01')
             <if test="companyId != null">
-                AND company_id = ${companyId}
+                AND company_id = #{companyId}
             </if>
         </where>
     </select>
@@ -259,10 +259,10 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
                 and company_id = #{companyId}
             </if>
             <if test="courseId != null">
-                and course_id = ${courseId}
+                and course_id = #{courseId}
             </if>
             <if test="project != null">
-                and project = ${project}
+                and project = #{project}
             </if>
             <if test="common == null">
                 AND company_id IS not NULL

fs-service/src/main/resources/mapper/course/FsUserCourseTrainingCampMapper.xml

@@ -37,7 +37,7 @@
         <choose>
             <when test="params.scs != null and params.scs.size() > 0">
                 <foreach collection="params.scs" item="sc" separator=",">
-                    ${sc.column} ${sc.order}
+                    <choose><when test="sc.column == 'order_number'">order_number</when><when test="sc.column == 'training_camp_name'">training_camp_name</when><when test="sc.column == 'training_camp_id'">training_camp_id</when><otherwise>training_camp_id</otherwise></choose> <choose><when test="sc.order == 'ASC'">ASC</when><otherwise>DESC</otherwise></choose>
                 </foreach>
             </when>
             <otherwise>

fs-service/src/main/resources/mapper/his/FsPackageOrderMapper.xml

@@ -318,7 +318,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         where O.is_pay = 1 ORDER BY RAND() desc LIMIT 20
     </select>
     <select id="selectOutTimeOrderList" resultType="com.fs.his.domain.FsPackageOrder">
-        select * from fs_package_order  where status = 1 AND NOW() &gt; DATE_ADD(create_time, INTERVAL ${unPayTime} MINUTE)
+        select * from fs_package_order  where status = 1 AND NOW() &gt; DATE_ADD(create_time, INTERVAL #{unPayTime} MINUTE)
     </select>
     <select id="selectInformationCollectionByStoreOrderId" resultType="com.fs.his.vo.FsUserInfoCollectionAndStoreOrderVo">
         SELECT ic.* FROM `fs_package_order` po

fs-service/src/main/resources/mapper/his/FsStoreOrderMapper.xml

@@ -953,7 +953,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             so.pay_money
         </if>
         <if test="maps.sortOrder != null and maps.sortOrder != ''">
-            ${maps.sortOrder}
+            <choose><when test="maps.sortOrder == 'ASC'">ASC</when><otherwise>DESC</otherwise></choose>
         </if>
         <if test="maps.sortField == null or maps.sortField == ''">
             so.order_id desc
@@ -1177,7 +1177,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             so.pay_money
         </if>
         <if test="maps.sortOrder != null and maps.sortOrder != ''">
-            ${maps.sortOrder}
+            <choose><when test="maps.sortOrder == 'ASC'">ASC</when><otherwise>DESC</otherwise></choose>
         </if>
         <if test="maps.sortField == null or maps.sortField == ''">
             so.order_id desc
@@ -1656,7 +1656,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             so.pay_money
         </if>
         <if test="maps.sortOrder != null and maps.sortOrder != ''">
-            ${maps.sortOrder}
+            <choose><when test="maps.sortOrder == 'ASC'">ASC</when><otherwise>DESC</otherwise></choose>
         </if>
         <if test="maps.sortField == null or maps.sortField == ''">
             so.order_id desc
@@ -2153,7 +2153,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
     </select>
     <select id="selectOutTimeOrderList" resultType="com.fs.his.domain.FsStoreOrder">
         <include refid="selectFsStoreOrderVo"/>
-        where is_del = 0 and status = 1 and NOW() &gt; DATE_ADD(create_time, INTERVAL ${unPayTime} MINUTE)
+        where is_del = 0 and status = 1 and NOW() &gt; DATE_ADD(create_time, INTERVAL #{unPayTime} MINUTE)
     </select>
 
 </mapper>

fs-service/src/main/resources/mapper/his/FsUserMapper.xml

@@ -392,7 +392,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             <if test="companyUserIds != null and companyUserIds.size > 0">
                 AND ucu.company_user_id in
                 <foreach collection="companyUserIds" item="item" index="index" open="(" separator="," close=")">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="nickname != null and nickname != ''">
@@ -408,7 +408,8 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
                 AND fs_user.create_time &gt;= #{sTime} AND fs_user.create_time &lt;= #{eTime}
             </if>
         </where>
-        limit ${(pageNum-1)*pageSize},${pageSize}
+        <bind name="offset" value="(pageNum-1)*pageSize" />
+        limit #{offset}, #{pageSize}
     </select>
 
     <select id="selectFsUserPageListCount" resultType="java.lang.Long">
@@ -434,7 +435,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             <if test="companyUserIds != null and companyUserIds.size > 0">
                 AND ucu.company_user_id in
                 <foreach collection="companyUserIds" item="item" index="index" open="(" separator="," close=")">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="nickname != null and nickname!=''">
@@ -454,7 +455,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         where
         user_id in
         <foreach collection="userIds" open="(" close=")" separator="," item="item">
-            ${item}
+            #{item}
         </foreach>
     </update>
 

fs-service/src/main/resources/mapper/hisStore/FsStoreOrderScrmMapper.xml

@@ -1268,7 +1268,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             o.pay_money
         </if>
         <if test="maps.sortOrder != null and maps.sortOrder != ''">
-            ${maps.sortOrder}
+            <choose><when test="maps.sortOrder == 'ASC'">ASC</when><otherwise>DESC</otherwise></choose>
         </if>
         <if test="maps.sortField == null or maps.sortField == ''">
             o.id desc
@@ -1888,7 +1888,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             o.pay_money
         </if>
         <if test="maps.sortOrder != null and maps.sortOrder != ''">
-            ${maps.sortOrder}
+            <choose><when test="maps.sortOrder == 'ASC'">ASC</when><otherwise>DESC</otherwise></choose>
         </if>
         <if test="maps.sortField == null or maps.sortField == ''">
             o.id desc

fs-service/src/main/resources/mapper/hisStore/FsUserCourseCountScrmMapper.xml

@@ -63,7 +63,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             ifnull ( sum( fs_user_course_count.part_course_count ), 0 ) AS part_course_count,
             Max( fs_user_course_count.last_watch_date ) AS last_watch_date,
             Max( fs_user_course_count.complete_watch_date) AS complete_watch_date
-            from fs_user_course_count where user_id = ${userId}
+            from fs_user_course_count where user_id = #{userId}
     </select>
 
     <insert id="insertFsUserCourseCount">

fs-service/src/main/resources/mapper/hisStore/FsUserScrmMapper.xml

@@ -202,7 +202,8 @@
             </if>
         </where>
         order by u.user_id desc
-        limit ${(pageNum-1)*pageSize},${pageSize}
+        <bind name="offset" value="(pageNum-1)*pageSize" />
+        limit #{offset}, #{pageSize}
         ) t on t.user_id = `user`.user_id
         left join company_user cu on cu.user_id = t.companyUserId
     </select>
@@ -577,7 +578,7 @@
         where
             user_id in
         <foreach collection="userIds" open="(" close=")" separator="," item="item">
-            ${item}
+            #{item}
         </foreach>
     </update>
 
@@ -628,7 +629,7 @@
             <if test="companyUserIds != null and companyUserIds.size > 0">
                 AND ucu.company_user_id in
                 <foreach collection="companyUserIds" item="item" index="index" open="(" separator="," close=")">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="nickname != null and nickname != ''">
@@ -640,7 +641,8 @@
             <if test="projectId != null">
                 AND ucu.project_id = #{projectId}
             </if>
-        limit ${(pageNum-1)*pageSize},${pageSize}
+        <bind name="offset" value="(pageNum-1)*pageSize" />
+        limit #{offset}, #{pageSize}
     </select>
 
     <select id="selectFsUserPageList" resultType="com.fs.store.vo.h5.FsUserPageListVO">
@@ -1695,7 +1697,7 @@
             <if test="companyUserIds != null and companyUserIds.size > 0">
                 AND ucu.company_user_id in
                 <foreach collection="companyUserIds" item="item" index="index" open="(" separator="," close=")">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="nickname != null and nickname!=''">

fs-service/src/main/resources/mapper/live/LiveDataMapper.xml

@@ -139,7 +139,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
                 END AS date_range,
         <choose>
             <when test="category == 'streams'"> COUNT(l.live_id) </when>
-            <otherwise> SUM(ld.${category}) </otherwise>
+            <otherwise> SUM(ld.<choose><when test="category == 'views'">views</when><when test="category == 'likes'">likes</when><when test="category == 'comments'">comments</when><when test="category == 'shares'">shares</when><otherwise>views</otherwise></choose>) </otherwise>
         </choose>
          AS views
             FROM live_data ld
@@ -189,7 +189,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
                 END AS date_range,
         <choose>
             <when test="category == 'streams'"> COUNT(l.live_id) </when>
-            <otherwise> SUM(ld.${category}) </otherwise>
+            <otherwise> SUM(ld.<choose><when test="category == 'views'">views</when><when test="category == 'likes'">likes</when><when test="category == 'comments'">comments</when><when test="category == 'shares'">shares</when><otherwise>views</otherwise></choose>) </otherwise>
         </choose>
          AS views
             FROM live_data ld

fs-service/src/main/resources/mapper/live/LiveOrderMapper.xml

@@ -814,7 +814,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
         o.pay_money
     </if>
     <if test="maps.sortOrder != null and maps.sortOrder != ''">
-        ${maps.sortOrder}
+        <choose><when test="maps.sortOrder == 'ASC'">ASC</when><otherwise>DESC</otherwise></choose>
     </if>
     <if test="maps.sortField == null or maps.sortField == ''">
         o.order_id desc

fs-service/src/main/resources/mapper/qw/HyWorkTaskMapper.xml

@@ -60,7 +60,8 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             <if test="companyUserId != null "> and t_inner.company_user_id = #{companyUserId}</if>
         </where>
         ORDER BY t_inner.score DESC, t_inner.id DESC
-        LIMIT ${(pageNum-1)*pageSize}, ${pageSize}
+        <bind name="offset" value="(pageNum-1)*pageSize" />
+        LIMIT #{offset}, #{pageSize}
         ) AS filtered_ids ON t.id = filtered_ids.id
         ORDER BY t.score DESC, t.id DESC
     </select>

fs-service/src/main/resources/mapper/qw/QwWatchLogMapper.xml

@@ -107,7 +107,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             <if test="companyUserIds != null and companyUserIds.size() != 0">
                 and company_user_id in
                 <foreach collection="companyUserIds" item="item" open="(" close=")" separator=",">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="project != null">
@@ -131,7 +131,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             <if test="companyUserIds != null">
                 and company_user_id in
                 <foreach collection="companyUserIds" item="item" open="(" close=")" separator=",">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="project != null">
@@ -160,7 +160,7 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             <if test="companyUserIds != null and companyUserIds.size() != 0">
                 and company_user_id in
                 <foreach collection="companyUserIds" item="item" open="(" close=")" separator=",">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="project != null">
@@ -175,7 +175,8 @@ PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
             and DATE(line_time) between #{sTime} and #{dTime}
         </where>
         group by project,course_id,video_id
-        limit ${(pageNum-1)*pageSize},${pageSize}
+        <bind name="offset" value="(pageNum-1)*pageSize" />
+        limit #{offset}, #{pageSize}
     </select>
     <select id="selectQwWatchLogByCompanyUserIdCount" resultType="java.lang.Long">
         SELECT COUNT(*)

fs-service/src/main/resources/mapper/sop/QwSopMapper.xml

@@ -467,7 +467,7 @@
             ]]>
             </if>
             <if test="companyId != null">
-                AND qw_sop.company_id = ${companyId}
+                AND qw_sop.company_id = #{companyId}
             </if>
         </where>
         ORDER BY qw_sop.create_time DESC

fs-service/src/main/resources/mapper/statis/ConsumptionBalanceMapper.xml

@@ -42,13 +42,13 @@
         select count(log_id) from fs_course_watch_log
         <where>
             <if test="userType != null">
-                and send_type=${userType}
+                and send_type=#{userType}
             </if>
             <if test="startTime != null and endTime != null">
                 and create_time between #{startTime} and #{endTime}
             </if>
             <if test="companyId != null">
-                and company_id = #{companyId}
+                AND company_id = #{companyId}
             </if>
         </where>
     </select>
@@ -57,13 +57,13 @@
         <where>
             finish_time is not null
             <if test="userType != null">
-                and send_type=${userType}
+                and send_type=#{userType}
             </if>
             <if test="startTime != null and endTime != null">
                 and create_time between #{startTime} and #{endTime}
             </if>
             <if test="companyId != null">
-                and company_id = #{companyId}
+                AND company_id = #{companyId}
             </if>
         </where>
     </select>
@@ -71,13 +71,13 @@
         select count(distinct user_id) from fs_course_watch_log
         <where>
             <if test="userType != null">
-                and send_type=${userType}
+                and send_type=#{userType}
             </if>
             <if test="startTime != null and endTime != null">
                 and create_time between #{startTime} and #{endTime}
             </if>
             <if test="companyId != null">
-                and company_id = #{companyId}
+                AND company_id = #{companyId}
             </if>
 
         </where>
@@ -90,10 +90,10 @@
                  AND create_time BETWEEN #{startTime} AND #{endTime}
              </if>
              <if test="userType != null">
-                 and send_type=${userType}
+                 and send_type=#{userType}
              </if>
              <if test="companyId != null">
-                 and company_id = #{companyId}
+                 AND company_id = #{companyId}
              </if>
          </where>
     </select>
@@ -104,7 +104,7 @@
                create_time BETWEEN #{startTime} AND #{endTime}
            </if>
            <if test="companyId != null">
-               and company_id = #{companyId}
+               AND company_id = #{companyId}
            </if>
        </where>
     </select>
@@ -116,7 +116,7 @@
                 and create_time BETWEEN #{startTime} AND #{endTime}
             </if>
             <if test="companyId != null">
-                and company_id = #{companyId}
+                AND company_id = #{companyId}
             </if>
         </where>
     </select>
@@ -129,7 +129,7 @@
                 and rpl.create_time BETWEEN #{startTime} AND #{endTime}
             </if>
             <if test="userType != null">
-                and log.send_type = ${userType}
+                and log.send_type = #{userType}
             </if>
             <if test="companyId != null">
                 and log.company_id = #{companyId}
@@ -145,7 +145,7 @@
                 and rpl.create_time BETWEEN #{startTime} AND #{endTime}
             </if>
             <if test="userType != null">
-                and log.send_type = ${userType}
+                and log.send_type = #{userType}
             </if>
             <if test="companyId != null">
                 and log.company_id = #{companyId}
@@ -190,7 +190,7 @@
                 AND create_time <![CDATA[<]]> #{endTime}
             </if>
             <if test="userType != null">
-                AND send_type = ${userType}
+                AND send_type = #{userType}
             </if>
         </where>
         GROUP BY
@@ -220,10 +220,10 @@
                 AND create_time <![CDATA[<]]> #{endTime}
             </if>
             <if test="userType != null">
-                AND send_type = ${userType}
+                AND send_type = #{userType}
             </if>
             <if test="companyId != null">
-                AND company_id = ${companyId}
+                AND company_id = #{companyId}
             </if>
         </where>
         GROUP BY company_id
@@ -423,10 +423,10 @@
                 AND rpl.create_time <![CDATA[<]]> #{endTime}
             </if>
             <if test="userType != null">
-                and log.send_type = ${userType}
+                and log.send_type = #{userType}
             </if>
             <if test="companyId != null">
-                and log.company_id = ${companyId}
+                and log.company_id = #{companyId}
             </if>
         </where>
         GROUP BY
@@ -462,10 +462,10 @@
                 AND rpl.create_time <![CDATA[<]]> #{endTime}
             </if>
             <if test="userType != null">
-                and log.send_type = ${userType}
+                and log.send_type = #{userType}
             </if>
             <if test="companyId != null">
-                and log.company_id = ${companyId}
+                and log.company_id = #{companyId}
             </if>
         </where>
         group by start_date
@@ -509,7 +509,7 @@
                 (select COUNT(*) FROM qw_user
                 <where>
                     <if test="companyId != null">
-                       AND company_id = ${companyId}
+                       AND company_id = #{companyId}
                     </if>
                 </where>
         ) AS qw_member_num

fs-service/src/main/resources/mapper/statis/FsStatisEveryDayMapper.xml

@@ -144,13 +144,13 @@
             <if test="userIds != null and userIds.length > 0">
                 AND company_user_id IN
                 <foreach collection="userIds" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="periodList != null and periodList.length > 0">
                 AND period_id IN
                 <foreach collection="periodList" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="startDate != null and endDate != null">

fs-service/src/main/resources/mapper/statis/FsStatisPeriodWatchMapper.xml

@@ -42,13 +42,13 @@
             <if test="userIds != null and userIds.length > 0">
                 AND company_user_id IN
                 <foreach collection="userIds" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="periodList != null and periodList.length > 0">
                 AND period_id IN
                 <foreach collection="periodList" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="startDate != null and endDate != null">

fs-service/src/main/resources/mapper/statis/FsStatisSalerWatchMapper.xml

@@ -59,7 +59,7 @@
             <if test="userIds != null and userIds.size() > 0">
                 AND company_user_id IN
                 <foreach collection="userIds" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="periodList != null and periodList.size() > 0">
@@ -117,7 +117,7 @@
             <if test="userIds != null and userIds.size() > 0">
                 AND company_user_id IN
                 <foreach collection="userIds" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="periodList != null and periodList.size() > 0">
@@ -166,7 +166,7 @@
             <if test="userIds != null and userIds.size() > 0">
                 AND company_user_id IN
                 <foreach collection="userIds" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="periodList != null and periodList.size() > 0">
@@ -226,7 +226,7 @@
             <if test="userIds != null and userIds.size() > 0">
                 AND watch.company_user_id IN
                 <foreach collection="userIds" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="periodList != null and periodList.size() > 0">
@@ -353,7 +353,7 @@
             <if test="userIds != null and userIds.size() > 0">
                 AND company_user_id IN
                 <foreach collection="userIds" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="periodList != null and periodList.size() > 0">
@@ -402,7 +402,7 @@
             <if test="userIds != null and userIds.size() > 0">
                 AND company_user_id IN
                 <foreach collection="userIds" open="(" close=")" separator="," item="item">
-                    ${item}
+                    #{item}
                 </foreach>
             </if>
             <if test="periodList != null and periodList.size() > 0">

fs-service/src/main/resources/mapper/store/FsUserCourseCountMapper.xml

@@ -63,7 +63,7 @@
             ifnull ( sum( fs_user_course_count.part_course_count ), 0 ) AS part_course_count,
             Max( fs_user_course_count.last_watch_date ) AS last_watch_date,
             Max( fs_user_course_count.complete_watch_date) AS complete_watch_date
-        from fs_user_course_count where user_id = ${userId}
+        from fs_user_course_count where user_id = #{userId}
     </select>
 
     <insert id="insertFsUserCourseCount">