diff --git a/lxDb/sql.go b/lxDb/sql.go index e57e520..a6df73d 100644 --- a/lxDb/sql.go +++ b/lxDb/sql.go @@ -2,6 +2,7 @@ package lxDb import ( "errors" + "fmt" "git.listensoft.net/tool/lxutils/lxUtil" "gorm.io/gorm" "regexp" @@ -283,11 +284,8 @@ func SqlQuery(tx *gorm.DB, sql string, list interface{}, q *PaginationQuery, par if !isSafeSQL(q.OrderBy) { return errors.New("环境异常") } - safeOrderBy := sanitizeOrderBy(q.OrderBy) - if safeOrderBy != "" { - builder.WriteString(" ORDER BY ") - builder.WriteString(safeOrderBy) - } + s := fmt.Sprintf(" ORDER BY %s", lxUtil.FieldToColumn(q.OrderBy)) // TODO: q.OrderBy是字符串,可能多个字段 会有问题吗 + builder.WriteString(s) } // 安全地处理分页 - 使用参数化查询