參數化查詢ORM與在條款

Question

我想參數化是目前正在和已經成熟的SQL注入攻擊的查詢：

qryAwards = ORMExecuteQuery(
    "from Award where awardID in (#form.deleteAwardList#) and Game.Season.User.userID=:uid", 
    {uid=session.userID} 
); 
if(not isNull(qryAwards) and arrayLen(qryAwards)){ 
    for(i in qryAwards){ 
     entityDelete(i); 
    } 
} 

我想這一點，有沒有單引號帕拉姆：

qryAwards = ORMExecuteQuery(
    "from Award where awardID in (:awardList) and Game.Season.User.userID=:uid", 
    {awardList=form.deleteAwardList, uid=session.userID} 
); 

我不斷收到以下錯誤：

The value 117,118 cannot be converted to a number.

而這一點，用單引號括起來帕拉姆：

qryAwards = ORMExecuteQuery(
    "from Award where awardID in (':awardList') and Game.Season.User.userID=:uid", 
    {awardList=form.deleteAwardList, uid=session.userID} 
); 

獲取我下面的錯誤：

Invalid parameters specified for the query.

Answer 1

在HQL（這是當你做ORMExecuteQuery()你用什麼）使用的參數在IN子句中需要作爲數組傳遞。您需要將form.deleteAwardList轉換爲數組。有幾種不同的方式來處理這個問題，但這會起作用。

qryAwards = ORMExecuteQuery(
    "from Award where awardID in (:awardList) and Game.Season.User.userID=:uid", 
    {awardList=listToArray(form.deleteAwardList), uid=session.userID} 
);