pagehelper-org/Mybatis-PageHelper · error · PageException

order by [ ] has a risk of SQL injection, if you want to…

Error message

order by [${orderBy}] has a risk of SQL injection, if you want to avoid SQL injection verification, you can call Page.setUnsafeOrderBy

What it means

PageHelper validates the orderBy string passed to a Page object with SqlSafeUtil to prevent SQL injection, since ORDER BY clauses cannot be parameterized. If the string contains characters deemed unsafe (quotes, comments, multiple tokens that look like injected SQL), a PageException is thrown before any query runs. The library offers setUnsafeOrderBy to bypass this check when you intentionally use functions in ORDER BY.

Solutions

Sanitize the orderBy value: only allow whitelisted column names and directions before calling setOrderBy.
If the value is trusted and you need functions/expressions, call page.setUnsafeOrderBy(orderBy) instead of setOrderBy.
Map user input to fixed internal sort keys instead of passing raw strings.
Intercept on the API layer: reject/revert inputs containing quotes, semicolons, or comment markers.

Example fix

// before
PageHelper.startPage(pageNum, pageSize, request.getParameter("sort"));
// after
String sort = request.getParameter("sort");
if ("price".equals(sort)) {
    PageHelper.startPage(pageNum, pageSize, "price desc");
} else {
    PageHelper.startPage(pageNum, pageSize, "id desc"); // whitelist
}

Defensive patterns

Strategy: validation

Validate before calling

private static final Pattern SAFE_ORDER = Pattern.compile("^[a-zA-Z0-9_.]+(\\s+(asc|desc))?$", Pattern.CASE_INSENSITIVE);
static void assertSafeOrderBy(String orderBy) {
    if (orderBy == null || !SAFE_ORDER.matcher(orderBy.trim()).matches()) {
        throw new IllegalArgumentException("unsafe orderBy: " + orderBy);
    }
}

Type guard

static boolean isSafeOrderBy(String s) {
    return s != null && s.matches("[\\w.,\\s()]+") && !s.matches(".*('|;|--|/\\*).*");
}

Try / catch

try {
    PageHelper.orderBy(orderBy);
} catch (PageException e) {
    log.warn("Rejected orderBy: {}", orderBy, e);
    PageHelper.orderBy("id desc"); // safe default
}

Prevention

Never pass raw request parameters into setOrderBy; map to a whitelist of allowed sort keys.
Only use setUnsafeOrderBy for trusted, developer-controlled strings.
Unit test every sort expression string you ship with SqlSafeUtil.check().
Reject quotes, semicolons, and comment markers at the API validation layer.

When it happens

Trigger: Calling Page.setOrderBy(String) (directly or via PageHelper.orderBy(...), PageHelper.startPage(page,size,orderBy), PageHelper.offsetPage, or PageHelper.getPageFromObject binding an orderBy param) with a string SqlSafeUtil.check() rejects, e.g. containing single quotes, semicolons, or SQL comments.

Common situations: Passing a sort string straight from an HTTP request parameter (user-controlled 'sort=name; DROP TABLE x' or 'id desc--'), or intentionally using ORDER BY functions like 'if(is_valid=1, id, create_time) desc' which the safe check rejects.

Related errors

AI-assisted analysis of pagehelper-org/Mybatis-PageHelper@c692616c5b (2026-09-08). Data as JSON: /api/errors/159f19a892557ee6. Report an issue: GitHub.

Appendix: source

Thrown at src/main/java/com/github/pagehelper/Page.java:284

    public Page<E> setPageSizeZero(Boolean pageSizeZero) {
        if (this.pageSizeZero == null && pageSizeZero != null) {
            this.pageSizeZero = pageSizeZero;
        }
        return this;
    }

    public String getOrderBy() {
        return orderBy;
    }

    /**
     * 设置排序字段，增加 SQL 注入校验，如果需要在 order by 使用函数，可以使用 {@link #setUnsafeOrderBy(String)} 方法
     *
     * @param orderBy 排序字段
     */
    public <E> Page<E> setOrderBy(String orderBy) {
        if (SqlSafeUtil.check(orderBy)) {
            throw new PageException("order by [" + orderBy + "] has a risk of SQL injection, " +
                    "if you want to avoid SQL injection verification, you can call Page.setUnsafeOrderBy");
        }
        this.orderBy = orderBy;
        return (Page<E>) this;
    }

    /**
     * 不安全的设置排序方法，如果从前端接收参数，请自行做好注入校验。
     * <p>
     * 请不要故意使用该方法注入然后提交漏洞!!!
     *
     * @param orderBy 排序字段
     */
    public <E> Page<E> setUnsafeOrderBy(String orderBy) {
        this.orderBy = orderBy;
        return (Page<E>) this;
    }

View on GitHub (pinned to c692616c5b)