spring+springMVC+myBatis整合

package com.liuyp.ssm.action; import java.util.List; import javax.annotation.Resource; import org.springframework.stereotype.Controller; import org.springframework.ui.ModelMap; import org.springframework.web.bind.annotation.ModelAttribute; import org.springframework.web.bind.annotation.RequestMapping; import org.springframework.web.bind.annotation.RequestParam; import org.springframework.web.bind.annotation.SessionAttributes; import org.springframework.web.servlet.ModelAndView; import com.liuyp.ssm.entities.Employee; import com.liuyp.ssm.mapper.EmployeeMapper; @Controller @RequestMapping("/ok") @SessionAttributes({"msg1","msg2"}) public class OkController{ @Resource private EmployeeMapper empMapper; @RequestMapping(params="method=ok1") public String okAction1(@RequestParam("uname") String uname, ModelMap map){ map.put("msg1", uname); System.out.println(uname); return "ok1"; } @RequestMapping(params="method=ok2") public ModelAndView okAction2(@ModelAttribute("msg1") String uname, ModelMap map){ map.put("msg2", uname); ModelAndView mav = new ModelAndView("ok2"); return mav; } @RequestMapping("/ok3.action") public ModelAndView okAction3(@ModelAttribute("msg1") String uname, ModelMap map){ map.put("msg2", uname); ModelAndView mav = new ModelAndView("ok2"); return mav; } @RequestMapping("/ok4.action") public ModelAndView okAction4(ModelMap map) throws Exception{ List<Employee> emps = empMapper.selectAll(); Employee empByID = empMapper.selectAllByID(1); List<Employee> empByName = empMapper.selectAllByName("D' or 1=1 or email like '");// sql注入 String fEmail = empMapper.selectColumnByID(2); System.out.println("emps = " + emps.toString()); System.out.println("empByID = " + empByID); System.out.println("empByName = " + empByName.toString()); System.out.println("fEmail = " + fEmail); map.put("msg2", emps); ModelAndView mav = new ModelAndView("ok2"); return mav; } }