修复SQL错误：解决student_id列不存在问题及SQL注入风险

src/main/java/com/njuzr/eaibackend/service/impl/ClassServiceImpl.java

@@ -12,6 +12,7 @@ import com.njuzr.eaibackend.po.ClassStudent;
 import com.njuzr.eaibackend.po.User;
 import com.njuzr.eaibackend.service.ClassService;
 import com.njuzr.eaibackend.vo.StudentInfoVO;
+import com.njuzr.eaibackend.vo.ClassVO;
 import com.opencsv.CSVReader;
 import com.opencsv.exceptions.CsvValidationException;
 import lombok.extern.slf4j.Slf4j;
@@ -27,7 +28,9 @@ import java.io.InputStreamReader;
 import java.math.BigDecimal;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.Random;
 import java.util.stream.Collectors;
+import org.springframework.beans.BeanUtils;
 
 @Slf4j
 @Service
@@ -64,7 +67,7 @@ public class ClassServiceImpl implements ClassService {
         return convertToVO(aClass);
     }
 
-    private String generateClassCode() {
+    public String generateClassCode() {
         // 生成6位字母数字组合的班级码
         String characters = "ABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789";
         Random random = new Random();
@@ -85,7 +88,7 @@ public class ClassServiceImpl implements ClassService {
         return classCode;
     }
 
-    private boolean isClassCodeUnique(String classCode) {
+    public boolean isClassCodeUnique(String classCode) {
         QueryWrapper<Class> wrapper = new QueryWrapper<>();
         wrapper.eq("class_code", classCode);
         Class existingClass = classMapper.selectOne(wrapper);

src/main/java/com/njuzr/eaibackend/service/impl/CourseServiceImpl.java

@@ -9,17 +9,17 @@ import com.njuzr.eaibackend.dto.course.CourseQueryDTO;
 import com.njuzr.eaibackend.dto.course.CourseUpdateDTO;
 import com.njuzr.eaibackend.dto.course.EnrollDTO;
 import com.njuzr.eaibackend.enums.AssignmentCompletionStatus;
+import com.njuzr.eaibackend.enums.ClassStudentState;
 import com.njuzr.eaibackend.enums.Role;
 import com.njuzr.eaibackend.exception.MyException;
-import com.njuzr.eaibackend.mapper.ClassMapper;
 import com.njuzr.eaibackend.mapper.*;
 import com.njuzr.eaibackend.po.*;
+import com.njuzr.eaibackend.po.Class;
 import com.njuzr.eaibackend.service.CourseService;
 import com.njuzr.eaibackend.utils.ConvertUtil;
 import com.njuzr.eaibackend.utils.ModelMapperUtil;
 import com.njuzr.eaibackend.utils.PageMapperUtil;
-import com.njuzr.eaibackend.vo.CourseVO;
-import com.njuzr.eaibackend.vo.UserVO;
+import com.njuzr.eaibackend.vo.*;
 import lombok.extern.slf4j.Slf4j;
 import org.springframework.beans.BeanUtils;
 import org.springframework.beans.factory.annotation.Autowired;
@@ -27,16 +27,6 @@ import org.springframework.cache.annotation.CacheEvict;
 import org.springframework.http.HttpStatus;
 import org.springframework.stereotype.Service;
 import org.springframework.transaction.annotation.Transactional;
-import com.njuzr.eaibackend.enums.AssignmentCompletionStatus;
-import com.njuzr.eaibackend.mapper.AssignmentMapper;
-import com.njuzr.eaibackend.mapper.StudentAssignmentMapper;
-import com.njuzr.eaibackend.mapper.UserMapper;
-import com.njuzr.eaibackend.po.Assignment;
-import com.njuzr.eaibackend.po.StudentAssignment;
-import com.njuzr.eaibackend.po.User;
-import com.njuzr.eaibackend.vo.StudentCourseAssignmentVO;
-import com.njuzr.eaibackend.vo.StudentCourseHomeworkVO;
-import org.springframework.stereotype.Service;
 import java.time.LocalDate;
 import java.time.format.DateTimeFormatter;
 import java.util.*;
@@ -149,7 +139,8 @@ public class CourseServiceImpl implements CourseService {
         }
 
         if (courseQueryDTO.getStudentId() != null) { // 联表查询学生所选课程
-            wrapper.inSql("course_id", "SELECT course_id FROM course_student WHERE student_id = " + courseQueryDTO.getStudentId());
+            // 使用安全的参数绑定方式
+            wrapper.apply("course_id IN (SELECT course_id FROM course_student WHERE student_id = {0})", courseQueryDTO.getStudentId());
         }
 
         if (courseQueryDTO.getSemester() != null && !courseQueryDTO.getSemester().trim().isEmpty()) { // 课程时间过滤，转换成具体日期
@@ -317,10 +308,12 @@ public class CourseServiceImpl implements CourseService {
         }
     }
 
+    
     /**
      * 学生选课。给course_student表添加记录。
      * @param enrollDTO
      */
+    /** 
     @Override
     @Transactional
     public void enroll(EnrollDTO enrollDTO) {
@@ -355,7 +348,7 @@ public class CourseServiceImpl implements CourseService {
         log.error("更新学生 {} 在课程 {} 中的加入状态失败", studentId, courseId);
         throw MyException.create(HttpStatus.BAD_REQUEST, "失败");
     }
-
+    */
 
     /**
      * 获取某课程的所有选课学生信息
@@ -454,7 +447,7 @@ public class CourseServiceImpl implements CourseService {
     @Transactional
     public void enrollByClassCode(EnrollDTO enrollDTO) {
         // 获取班级码
-        String classCode = enrollDTO.getClassCode();
+        String classCode = enrollDTO.getEnrollCode();
         Long studentId = enrollDTO.getStudentId();
         Long courseId = enrollDTO.getCourseId();
 
@@ -476,8 +469,8 @@ public class CourseServiceImpl implements CourseService {
 
         // 检查学生是否已经加入了该课程下的其他班级
         QueryWrapper<ClassStudent> csWrapper = new QueryWrapper<>();
-        csWrapper.eq("student_id", studentId);
         csWrapper.inSql("class_id", "SELECT class_id FROM class WHERE course_id = " + courseId);
+        csWrapper.inSql("official_number", "SELECT official_number FROM users WHERE id = " + studentId);
         ClassStudent existingClassStudent = classStudentMapper.selectOne(csWrapper);
 
         if (existingClassStudent != null) {
@@ -505,7 +498,6 @@ public class CourseServiceImpl implements CourseService {
 
         // 将学生加入班级
         ClassStudent classStudent = new ClassStudent();
-        classStudent.setStudentId(studentId);
         classStudent.setClassId(classId);
         classStudent.setState(ClassStudentState.JOINED); // 已加入状态