关于hibernate对sqlserver中表做count操作时的错误

2004-10-20 02:17:31 238 阅读 AI 写同款 · GEO 优化AI 选题数据监测一键分发 ›

高权限SQL注入实战：从数据库渗透到服务器控制 SQL注入作为Web安全领域的经典漏洞，其本质是攻击者通过构造恶意SQL语句，干扰应用程序与数据库的正常交互逻辑。在常规注入中，攻击者通常只能进行数据窃取或篡改；但当应用程序使用数据库最高权限账户（如MySQL的root、MSSQL的sa）连接时，漏洞的危害性将发生质变——攻击者可能获得系统命令执行、文件读写等能力，实现从数据库层到操作系统层的权限跃迁。这种高权限SQL注入的核心技术价值在于突破了传统的数据窃取范畴，直接威胁服务器安全。其典型应用场景包括老旧内容管理系统、内部管理后台及配置不当的运维脚本等。阅读详情

表结构

/*==============================================================*/
/* Table: customer_unit_info */
/*==============================================================*/
create table customer_unit_info (
customer_unit_id numeric identity,
unit_id integer null,
card_number varchar(20) not null,
customer_unit_name varchar(70) not null,
customer_unit_manager varchar(12) null,
customer_unit_bank_name varchar(50) not null,
customer_unit_bank_code varchar(30) not null,
customer_unit_address varchar(70) null,
customer_unit_phone varchar(20) null,
customer_unit_phone2 varchar(20) null,
customer_unit_postcode varchar(8) null,
customer_unit_fax varchar(20) null,
constraint PK_CUSTOMER_UNIT_INFO primary key (customer_unit_id)
)
go

对应的hbm文件内容

<?xml version="1.0"?>
<!DOCTYPE hibernate-mapping PUBLIC
"-//Hibernate/Hibernate Mapping DTD 2.0//EN"
"http://hibernate.sourceforge.net/hibernate-mapping-2.0.dtd" >



<hibernate-mapping package="com.bkgd.water.dao.tables">

<class name="CustomerUnitInfo" table="customer_unit_info">
<id name="customerUnitId" column="customer_unit_id" type="java.lang.Long">
<generator class="identity"/>
</id>

<property name="unitId" column="unit_id" type="java.lang.Integer" />
<property name="cardNumber" column="card_number" type="java.lang.String" not-null="true" />
<property name="customerUnitName" column="customer_unit_name" type="java.lang.String" not-null="true" />
<property name="customerUnitManager" column="customer_unit_manager" type="java.lang.String" />
<property name="customerUnitBankName" column="customer_unit_bank_name" type="java.lang.String" not-null="true" />
<property name="customerUnitBankCode" column="customer_unit_bank_code" type="java.lang.String" not-null="true" />
<property name="customerUnitAddress" column="customer_unit_address" type="java.lang.String" />
<property name="customerUnitPhone" column="customer_unit_phone" type="java.lang.String" />
<property name="customerUnitPhone2" column="customer_unit_phone2" type="java.lang.String" />
<property name="customerUnitPostcode" column="customer_unit_postcode" type="java.lang.String" />
<property name="customerUnitFax" column="customer_unit_fax" type="java.lang.String" />
</class>

</hibernate-mapping>

...全文

TortoiseGit之配置密钥基于github的开发必须要用到rsa密钥，因此需要用到TortoiseGit的putty key generator工具，来生成既适用于github的rsa密钥也适用于TortoiseGit的ppk密钥。阅读详情

peihexian

Java EE 67,535 成员 225,843 内容

+ 关注 + 加入社区

切换为时间正序

peihexian 2004-10-20

打赏
举报

谢谢大家，问题已经解决，有两个原因：
1.一个是原来我写的HSQL是select count(c.*) from customer_unit_info c
这样写不对，改成select count(c) from customer_unit_info c 或
select count(*) from customer_unit_info c 都可以工作了。

2.我犯了一个极大极大的低级错误，那就jsp调错javabean了，我折腾了一下午，以为是Hibernate的HSQL语句有问题，只到最后才发现我一直在反复修改的是一个别的Javabean，因为不知道什么时候我从CVS里Check out了一个旧版本的jsp出来。

trk_computer 2004-10-20

打赏
举报

你把TOMCAT停下来
然后的work目录删了
再重新启动TOMCAT
试试看

zhigangsun 2004-10-20

打赏
举报

好像hibernate对聚合函数支持的不是很好哦。

peihexian 2004-10-20

打赏
举报

to dengyin2000(dengyin2000) :
问题依旧，苦啊。

说说其他的情况：sql server 2000 sp3,jdbc是从ms网站下载的最新版本,os是win2000 server sp4,
开发工具：Eclipse+MyEclipse，Tomcat 4.1.30。

出错的一个通用分页javabean，我打算在未知用户想显示哪个具体类以及哪些具体字段(类的属性)的情况下实现一个通用分页类，目前已经基本做完，就差取记录总数这一块了。

peihexian 2004-10-20

打赏
举报

是的，已经重新编译过了，重启tomcat也试过了，重启系统都试了，my god，这么一个小问题卡在这，一个下午也没心情做别的模块。

dengyin2000 2004-10-20

打赏
举报

count(*) from Archive arch where arch.category = 'java'

sgdb 2004-10-20

打赏
举报

改了以后工程rebuild的了吗？

peihexian 2004-10-20

打赏
举报

Hibernate: select count(customerun0_.customer_unit_id*) as x0_0_ from customer_u
nit_info customerun0_
16:29:06,593 WARN JDBCExceptionReporter:38 - SQL Error: 170, SQLState: HY000
16:29:07,125 ERROR JDBCExceptionReporter:46 - [Microsoft][SQLServer 2000 Driver
for JDBC][SQLServer]第 1 行: ')' 附近有语法错误。
16:29:07,140 WARN JDBCExceptionReporter:38 - SQL Error: 170, SQLState: HY000
16:29:07,156 ERROR JDBCExceptionReporter:46 - [Microsoft][SQLServer 2000 Driver
for JDBC][SQLServer]第 1 行: ')' 附近有语法错误。
16:29:07,265 ERROR JDBCExceptionReporter:38 - Could not execute query
java.sql.SQLException: [Microsoft][SQLServer 2000 Driver for JDBC][SQLServer]第
1 行: ')' 附近有语法错误。
at com.microsoft.jdbc.base.BaseExceptions.createException(Unknown Source
)
at com.microsoft.jdbc.base.BaseExceptions.getException(Unknown Source)
at com.microsoft.jdbc.sqlserver.tds.TDSRequest.processErrorToken(Unknown
Source)
at com.microsoft.jdbc.sqlserver.tds.TDSRequest.processReplyToken(Unknown
Source)
at com.microsoft.jdbc.sqlserver.tds.TDSExecuteRequest.processReplyToken(
Unknown Source)
at com.microsoft.jdbc.sqlserver.tds.TDSRequest.processReply(Unknown Sour
ce)
at com.microsoft.jdbc.sqlserver.SQLServerImplStatement.getNextResultType
(Unknown Source)
at com.microsoft.jdbc.base.BaseStatement.commonTransitionToState(Unknown
Source)
at com.microsoft.jdbc.base.BaseStatement.postImplExecute(Unknown Source)

at com.microsoft.jdbc.base.BasePreparedStatement.postImplExecute(Unknown
Source)
at com.microsoft.jdbc.base.BaseStatement.commonExecute(Unknown Source)
at com.microsoft.jdbc.base.BaseStatement.executeQueryInternal(Unknown So
urce)
at com.microsoft.jdbc.base.BasePreparedStatement.executeQuery(Unknown So
urce)
at net.sf.hibernate.impl.BatcherImpl.getResultSet(BatcherImpl.java:87)
at net.sf.hibernate.loader.Loader.getResultSet(Loader.java:875)
at net.sf.hibernate.hql.QueryTranslator.iterate(QueryTranslator.java:868
)
at net.sf.hibernate.impl.SessionImpl.iterate(SessionImpl.java:1609)
at net.sf.hibernate.impl.SessionImpl.iterate(SessionImpl.java:1582)
at net.sf.hibernate.impl.SessionImpl.iterate(SessionImpl.java:1574)
at com.bkgd.water.common.MultiPages.getRecordCount(MultiPages.java:82)
at com.bkgd.water.common.MultiPages.addTableFooter(MultiPages.java:27)
at com.bkgd.water.common.MultiPages.showContents(MultiPages.java:187)
at com.bkgd.water.common.MultiPages.ShowContents(MultiPages.java:195)
at com.bkgd.water.querys.UserManageBrowse.ShowPages(UserManageBrowse.jav
a:53)
at org.apache.jsp.Info_jsp._jspService(Info_jsp.java:208)
at org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:137)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper
.java:210)
at org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:2
95)
at org.apache.jasper.servlet.JspServlet.service(JspServlet.java:241)
at javax.servlet.http.HttpServlet.service(HttpServlet.java:853)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:247)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:193)
at com.bkgd.water.filter.CharFilter.doFilter(CharFilter.java:108)
at org.apache.catalina.core.ApplicationFilterChain.internalDoFilter(Appl
icationFilterChain.java:213)
at org.apache.catalina.core.ApplicationFilterChain.doFilter(ApplicationF
ilterChain.java:193)
at org.apache.catalina.core.StandardWrapperValve.invoke(StandardWrapperV
alve.java:256)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContex
t.invokeNext(StandardPipeline.java:643)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.jav
a:480)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:995)

at org.apache.catalina.core.StandardContextValve.invoke(StandardContextV
alve.java:191)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContex
t.invokeNext(StandardPipeline.java:643)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.jav
a:480)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:995)

at org.apache.catalina.core.StandardContext.invoke(StandardContext.java:
2422)
at org.apache.catalina.core.StandardHostValve.invoke(StandardHostValve.j
ava:180)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContex
t.invokeNext(StandardPipeline.java:643)
at org.apache.catalina.valves.ErrorDispatcherValve.invoke(ErrorDispatche
rValve.java:171)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContex
t.invokeNext(StandardPipeline.java:641)
at org.apache.catalina.valves.ErrorReportValve.invoke(ErrorReportValve.j
ava:163)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContex
t.invokeNext(StandardPipeline.java:641)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.jav
a:480)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:995)

at org.apache.catalina.core.StandardEngineValve.invoke(StandardEngineVal
ve.java:174)
at org.apache.catalina.core.StandardPipeline$StandardPipelineValveContex
t.invokeNext(StandardPipeline.java:643)
at org.apache.catalina.core.StandardPipeline.invoke(StandardPipeline.jav
a:480)
at org.apache.catalina.core.ContainerBase.invoke(ContainerBase.java:995)

at org.apache.coyote.tomcat4.CoyoteAdapter.service(CoyoteAdapter.java:19
9)
at org.apache.coyote.http11.Http11Processor.process(Http11Processor.java
:828)
at org.apache.coyote.http11.Http11Protocol$Http11ConnectionHandler.proce
ssConnection(Http11Protocol.java:700)
at org.apache.tomcat.util.net.TcpWorkerThread.runIt(PoolTcpEndpoint.java
:584)
at org.apache.tomcat.util.threads.ThreadPool$ControlRunnable.run(ThreadP
ool.java:683)
at java.lang.Thread.run(Thread.java:534)

sgdb 2004-10-20

打赏
举报

对了，报什么错误啊？？

追求自由 2004-10-20

打赏
举报

peihexian 2004-10-20

打赏
举报

气死了，换成2.1.3问题依旧！

peihexian 2004-10-20

打赏
举报

Hibernate: select count(customerun0_.customer_unit_id*) as x0_0_ from customer_unit_info customerun0_

to sgdb(神天月晓):
错误依旧，会不会是hibernate2.1.6有问题？

sgdb 2004-10-20

打赏
举报

select count(c) from CustomerUnitInfo c

peihexian 2004-10-20

打赏
举报

做统计的java代码
private int getRecordCount(String CountSQLString) {
int result = 0;
Session DbSession = null;
Transaction Tran = null;
try {
DbSession = HibernateSessionFactory.currentSession();
Tran = DbSession.beginTransaction();
result = ((Integer) DbSession.iterate(CountSQLString).next())
.intValue();
} catch (Exception e) {
e.printStackTrace();
} finally {
try {
Tran.rollback();
} catch (Exception e) {
}
try {
HibernateSessionFactory.closeSession();
} catch (Exception e) {
}
}
return result;
}
CountSQLString中要传入的HSQL为：
select count(*) from CustomerUnitInfo c

在tomcat 4.1.30 for windows中运行时，hibernate将我的那个HSQL转换为这样的了：

Hibernate: select count(customerun0_.customer_unit_id*) as x0_0_ from customer_unit_info customerun0_
毫无疑问，select count(customerun0_.customer_unit_id*)这样的sql是错误的，请问高人我的统计用的HSQL应该怎么写？
我试过select count(c.customerUnitId) from CustomerUnitInfo c 也不行，出来的结果和上面报的错是一样的。

郁闷，期待高手回答！

关于hibernate对sqlserver中表做count操作时的错误

相关推荐