JDBC database links, dynamic sql query prevent conditions flashback in sql injection;

// 表创建状态
if (StringUtils.isNotBlank(qo.getTabCreateStatus())) {
    String[]  statusArr =qo.getTabCreateStatus().split(",");
    pageSql += "   and  b.tab_create_status  in ( ";
    countSql += "  and  b.tab_create_status  in ( ";
    for(int i=0;i<statusArr.length;i++){
        pageSql +=((i>0) ? ",?" : "?");
        countSql +=((i>0) ? ",?" : "?");
        params.put(paramIndex++,statusArr[i]);
    }
    pageSql +=" )";
    countSql+=" )";
}