1: When querying the list, if no user information is passed in, the data of all users will be found out, and there will be security problems.
Special attention should be paid in the process of writing later
2: Similar to the first one, if the query condition is not written in the sql statement (the incoming parameter is not checked), it will also lead to the problem of information leakage