jfianlsql使用append拼接，防sql注入

  public Page getChannelByPage(int pageNum, int pageSize, Map paramMap){
        String sql = "SELECT * ";
        String orderBy = " ORDER BY id DESC";
        StringBuilder condition = new StringBuilder("");
        condition.append(" FROM tb_channel WHERE 1=1 ");

        List values = new ArrayList();

        if(StringUtils.isNotBlank(paramMap.get("channel_id"))){
            condition.append(" AND channel_id LIKE ?");
            values.add("'%"+paramMap.get("channel_id")+"%'" );
        }
        if(StringUtils.isNotBlank(paramMap.get("channel_name"))){
            condition.append(" AND channel_name LIKE ?");
            values.add("'%"+paramMap.get("channel_name")+"%'" );
        }
        Page channel = super.paginate(pageNum, pageSize, sql, condition + orderBy,values.toArray() );
        return channel;
    }