WHERE 1=1 永真條件,等同於無 WHERE 子句。SELECT * FROM t WHERE 1=1 ≡ SELECT * FROM t。同理 1<>2、'a'='a' 皆可。
場景:查詢介面有姓名、年齡、身高、體重四個可選欄位,使用者可任意組合。
String sql = "SELECT * FROM user";
boolean first = true;
if (!name.isEmpty()) {
sql += (first ? " WHERE " : " AND ") + "name = ?";
first = false;
}
if (!age.isEmpty()) {
sql += (first ? " WHERE " : " AND ") + "age = ?";
first = false;
}
// ... 需反覆判斷 first,極易出錯
String sql = "SELECT * FROM user WHERE 1=1";
if (!name.isEmpty()) sql += " AND name = ?";
if (!age.isEmpty()) sql += " AND age = ?";
if (!height.isEmpty()) sql += " AND height = ?";
if (!weight.isEmpty()) sql += " AND weight = ?";
// 統一用 AND 追加,無需判斷首條件
CREATE TABLE new_t AS SELECT * FROM old_t WHERE 1=1;
CREATE TABLE new_t AS SELECT * FROM old_t WHERE 1<>1; -- 或 WHERE 0=1
原查詢:SELECT * FROM user WHERE name = 'lala'
注入:name = 'lala' OR 1=1 → 變成全表查詢。
防禦:使用**參數化查詢**(PreparedStatement),永遠不要拼接用戶輸入。
where 1=1 不會出現在執行計畫中。WHERE 1=1 AND 尾隨(雖合法但不美觀)。