我在sql表达式中用了“>”符号，然后感觉sql就被截掉前面一段了，怎么处理呢

[cf19890919]

为了您的问题能得到及时准确解答，请认真填写下面各个选项，感谢您的配合。

• 当前使用的UReport的具体版本号：

  2.2.9

• 遇到的问题描述：

  我在sql表达式中用了“>”符号，然后感觉sql就被截掉前面一段了，怎么处理呢。 下面是我的sql表达式 ${ " SELECT" +" (SELECT b.dict_value FROM blade_dict b where b.code=\'inlay_order_status\' AND b.dict_key=o.order_type) order_status_name," +" o.order_no," +" (SELECT b.dept_name FROM blade_dept b where b.id= o.dept_id) dept_name," +" (SELECT b.warehouse_name FROM tb_basic_warehouse b where b.id=o.warehouse_id) warehouse_name," +" o.order_date," +" (SELECT b.dict_value FROM blade_dict b where b.code=\'storage_mode\' AND b.dict_key=o.storage_mode) storage_mode_name," +" (SELECT b.supplier_name FROM tb_basic_suppliers b where b.id=o.supplier_id) supplier_name," +" o.quantity_amount," +" o.gold_weight_amount," +" o.actual_price_amount," +" o.label_price_amount," +" (SELECT b.name FROM blade_user b where b.id=o.order_maker) order_marker_name," +" o.order_make_date," +" (SELECT b.name FROM blade_user b where b.id=o.auditor) auditor_name," +" o.audit_date," +" o.remark" +" FROM" +" tb_stock_inlayin_bound_order o" +" WHERE" +" o.tenant_id = :tenantId" +(emptyparam("deptId")==false ? " and dept_id=:deptId" : "") +(emptyparam("orderNo")==false ? " and order_no=:orderNo" : "") +(emptyparam("startOrderDate")==false ? " and order_date=:startOrderDate" : "") +(emptyparam("endOrderDate")==false ? " and order_date=:endOrderDate" : "") +(emptyparam("orderStatus")==false ? " and order_status=:orderStatus" : "") +(emptyparam("supplierId")==false ? " and supplier_id =:supplierId" : "") +" AND o.actual_price_amount > 0" +" AND o.is_deleted = 0" }

• 涉及到的异常信息（完整异常信息）：

  服务端错误：You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '0" +" AND o.is_deleted = 0" }' at line 1

• 相关截图：

[cf19890919]

是框架中xss 防攻击的配置引起的