mybatis直接执行完整sql及踩坑解决

List<LinkedHashMap<String , Object>> executeQuerySql(@Param("sql") String sql);

int executeCountSql(@Param("sql") String sql);

<select id="executeQuerySql" resultType="java.util.LinkedHashMap" parameterType="String">
        ${sql}
    </select>
    <select id="executeCountSql" resultType="java.lang.Integer" parameterType="String">
        ${sql}
    </select>

public static boolean sqlValidate(String sql) {
        String badStr = "'|and|exec|execute|insert|select|delete|update|count|drop|*|%|chr|mid|master|truncate|" +
                "char|declare|sitename|net user|xp_cmdshell|;|or|-|+|,|like'|and|exec|execute|insert|create|drop|" +
                "table|from|grant|use|group_concat|column_name|" +
                "information_schema.columns|table_schema|union|where|select|delete|update|order|by|count|*|" +
                "chr|mid|master|truncate|char|declare|or|;|-|--|+|,|like|//|/|%|#";//过滤掉的sql关键字，可以手动添加
        String[] badSplit = badStr.split("\\|");
        for (String s : badSplit) {
            if (sql.contains(s)) {
                return true;
            }
        }
        return false;
    }
}