【实战】5-2 用户登录相关功能开发

前言

接下来就要正式开始往之前搭建的结构中填充代码了，这些代码也不是一次完成的，我要纠结一下怎么来把这个学习过程明白的描写出来。可能有些类增加了多少就把那一部分写出来吧， 我大部分的上课笔记还是会写在代码的注释中，这样方便了记笔记，却让读者的思路顺序有些乱了，尽量表达的清楚一点吧~

以这种形式把上课学习内容写出来还真是有些别扭，以后可能我就只能挑着有意义的部分写了。

（20171025结束了不少校招面试，回来补项目经历，哈哈）最后我是把用户相关操作都做完了才来把这篇博客补全，没有更多的精力来把增量内容一点一点写出来了。这里不得不说一下，这里的MD5加密部分不严密，大家看看就行，不要学这里，我以后自己也要修改这一部分。

高可用服务响应对象

还是先贴代码，在common包下建立，同时还新建了ResponseCode枚举类，把一些状态码的列举放进去。
这样不管是底层service在数据库中查询出什么结果，都可以通过这个通用的对象返回，包括状态码status，一些提示消息msg，还有数据对象。这个对象返回给controller层后，也会修改或不修改的返回前端（浏览器）。

package top.winxblast.happymall.common;import org.codehaus.jackson.annotate.JsonIgnore;import org.codehaus.jackson.map.annotate.JsonSerialize;import java.io.Serializable;/** * 高可用服务响应对象 * JsonSerialize(include = JsonSerialize.Inclusion.NON_NULL)意思是 * 值为null时不要序列化，因为在生成错误对象时没有data，这时候就不要把data * 序列化进json了（有时候msg也为null）（保证序列化json的时候，如果是null的 * 对象，key也会消失） * * @author winxblast * @create 2017/10/19 **/@JsonSerialize(include = JsonSerialize.Inclusion.NON_NULL)public class ServerResponse<T> implements Serializable {    //这些都是在5-1接口设计中返回内容提到过的    /**     * 状态码     */    private int status;    /**     * 返回的消息     */    private String msg;    /**     * 返回数据，可以是一些类的json格式     * 泛型的好处：这样在返回的时候可以指定泛型里面的内容，也可以不指定泛型里面的强制类型     */    private T data;    //私有构造器,这里老师提到一种问题，我的理解就是泛型T万一是String类型    //那么构造方法会选择2，3中的哪一个？这个问题需要在后面public方法中考虑    //所以下面公开的方法要区分有message和data，不过调用构造方法是不会错的了    private ServerResponse(int status) {        this.status = status;    }    private ServerResponse(int status, T date) {        this.status = status;        this.data = date;    }    private ServerResponse(int status, String msg) {        this.status = status;        this.msg = msg;    }    private ServerResponse(int status, String msg, T data) {        this.status = status;        this.msg = msg;        this.data = data;    }    /**     * 根据状态码返回是否成功     * JsonIgnore使被注解内容不在json序列化结果当中     * 大概看了一下，JsonSerialize是通过getter方法来获取要序列化的内容的     * 所以哪个内容不想被包含，就加上jasonignore注解     * @return     */    @JsonIgnore    public boolean isSuccess() {        return this.status == ResponseCode.SUCCESS.getCode();    }    public int getStatus() {        return status;    }    public String getMsg() {        return msg;    }    public T getData() {        return data;    }    /**     * 通过该公开方法直接获取一个成功状态码的本对象     * @param <T>     * @return     */    public static <T> ServerResponse<T> createBySuccess() {        return new ServerResponse<T>(ResponseCode.SUCCESS.getCode());    }    public static <T> ServerResponse<T> createBySuccessMessage(String msg) {        return new ServerResponse<T>(ResponseCode.SUCCESS.getCode(), msg);    }    public static <T> ServerResponse<T> createBySuccess(T data) {        return new ServerResponse<T>(ResponseCode.SUCCESS.getCode(), data);    }    public static <T> ServerResponse<T> createBySuccess(String msg, T data) {        return new ServerResponse<T>(ResponseCode.SUCCESS.getCode(), msg, data);    }    /**     * 获取错误对象     * @param <T>     * @return     */    public static <T> ServerResponse<T> createByError() {        return new ServerResponse<T>(ResponseCode.ERROR.getCode(), ResponseCode.ERROR.getDesc());    }    public static <T> ServerResponse<T> createByErrorMessage(String errorMessage) {        return new ServerResponse<T>(ResponseCode.ERROR.getCode(), errorMessage);    }    public static <T> ServerResponse<T> createByErrorCodeMessage(int errorCode, String errorMessage) {        return new ServerResponse<T>(errorCode, errorMessage);    }}

响应编码的枚举类，与ServerResponse类配合使用

package top.winxblast.happymall.common;/** * 响应编码的枚举类 * * @author winxblast * @create 2017/10/19 **/public enum ResponseCode {    //以后想要扩展的时候修改下面这一部分就行了    SUCCESS(0,"SUCCESS"),    ERROR(1,"ERROR"),    NEED_LOGIN(10,"NEED_LOGIN"),    ILLEGAL_ARGUMENT(2,"ILLEGAL_ARGUMENT");    private final int code;    private final String desc;    //这里使用default的修饰，只允许类内部及本包调用，我不能很好理解这样的好处    ResponseCode(int code, String desc) {        this.code = code;        this.desc = desc;    }    public int getCode() {        return code;    }    public String getDesc() {        return desc;    }}

用户登录

在controller包下创建一个portal包，这个是门户的意思，是给前端用的，这里新建UserController类。可以看到这里的@RequestMapping注解是和上一节定义的用户接口相对应的。

package top.winxblast.happymall.controller.portal;import org.springframework.beans.factory.annotation.Autowired;import org.springframework.stereotype.Controller;import org.springframework.web.bind.annotation.RequestMapping;import org.springframework.web.bind.annotation.RequestMethod;import org.springframework.web.bind.annotation.ResponseBody;import top.winxblast.happymall.common.Const;import top.winxblast.happymall.common.ResponseCode;import top.winxblast.happymall.common.ServerResponse;import top.winxblast.happymall.pojo.User;import top.winxblast.happymall.service.IUserService;import javax.servlet.http.HttpSession;/** * 前台用户接口设计的控制层 * * @author winxblast * @create 2017/10/19 **/@Controller//因为都要给到这个地址下，所以放在类前面，方法前面放更细的地址@RequestMapping("/user/")public class UserController {    @Autowired    private IUserService iUserService;    /**     * 用户登录     * @param username     * @param password     * @param session     * @return     */    //这里login.do的设计要与之前的用户接口定义相同，method指定请求的方式    @RequestMapping(value = "login.do",method = RequestMethod.POST)    //responsebody注解表示返回时自动使用SpringMVC Jackson插件将返回值序列化为json    //它的配置在dispatcher-servlet.xml中    @ResponseBody    public ServerResponse<User> login(String username, String password, HttpSession session) {        //service-->mybatis-->dao        ServerResponse<User> response = iUserService.login(username,password);        if(response.isSuccess()) {            session.setAttribute(Const.CURRENT_USER, response.getData());        }        return response;    }    /**     * 用户登出     * @param session     * @return     */    //这里method也就只使用了GET方法，登出比较简单    @RequestMapping(value = "logout.do", method = RequestMethod.POST)    @ResponseBody    public ServerResponse<String> logout(HttpSession session) {        //登出就直接在session中把当前用户删除即可        session.removeAttribute(Const.CURRENT_USER);        return ServerResponse.createBySuccess();    }    /**     * 用户注册     * @param user     * @return     */    @RequestMapping(value = "register.do", method = RequestMethod.POST)    @ResponseBody    public ServerResponse<String> register(User user) {        return iUserService.register(user);    }    /**     * 检查用户名，email是否存在     * 虽然注册时已经含有这个检查了（注册中的检查是为了防止恶意调用注册接口）     * 这里的检查是为了返回前端一个检查结果，这样好实时显示     * @param str     * @param type 通过type是email还是username,去判断str     * @return     */    @RequestMapping(value = "check_valid.do", method = RequestMethod.POST)    @ResponseBody    public ServerResponse<String> checkValid(String str, String type) {        return iUserService.checkValid(str, type);    }    /**     * 获取用户信息     * @param session     * @return     */    @RequestMapping(value = "get_user_info.do", method = RequestMethod.POST)    @ResponseBody    public ServerResponse<User> getUserInfo(HttpSession session) {        User user = (User)session.getAttribute(Const.CURRENT_USER);        if(user != null) {            return ServerResponse.createBySuccess(user);        }        return ServerResponse.createByErrorMessage("用户未登录，无法获取当前用户信息");    }    /**     * 忘记密码，获得密码提示问题     * @param username     * @return     */    @RequestMapping(value = "forget_get_question.do", method = RequestMethod.POST)    @ResponseBody    public ServerResponse<String> forgetGetQuestion(String username) {        return iUserService.selectQuestion(username);    }    /**     * 验证密码提示问题的答案，token要放到ServerResponse的泛型T中     * 在写service时就会用到guava，先用本地的guava缓存来做token，利用     * 缓存的有效期来搞定token的有效期     * @param username     * @param question     * @param answer     * @return     */    @RequestMapping(value = "forget_check_answer.do", method = RequestMethod.POST)    @ResponseBody    public ServerResponse<String> forgetCheckAnswer(String username, String question, String answer) {        return iUserService.checkAnswer(username,question,answer);    }    /**     * 重置密码     * 现在更加能理解为什么要使用token的理由了，原来一直天真的以为验证答案正确     * 直接进行修改不是一连串的动作么，现在发现不是这样，修改密码是通过另外一个     * 接口的，那么破坏者就能利用那个没有验证答案的接口直接修改密码了     * @param username     * @param passwordNew     * @param forgetToken     * @return     */    @RequestMapping(value = "forget_reset_password.do", method = RequestMethod.POST)    @ResponseBody    public ServerResponse<String> forgetResetPassword(String username, String passwordNew, String forgetToken) {        return iUserService.forgetResetPassword(username, passwordNew, forgetToken);    }    /**     * 登录状态下重置密码     * @param session     * @param passwordOld     * @param passwordNew     * @return     */    @RequestMapping(value = "reset_password.do", method = RequestMethod.POST)    @ResponseBody    public ServerResponse<String> resetPassword(HttpSession session, String passwordOld, String passwordNew) {        User user = (User)session.getAttribute(Const.CURRENT_USER);        if(user == null) {            return ServerResponse.createByErrorMessage("用户未登录");        }        return iUserService.resetPassword(user, passwordOld, passwordNew);    }    /**     * 更新用户信息     * @param session     * @param user     * @return 这里消息的泛型选择User，这样把新的用户信息更新到session中，返回前端后，前端也要把新信息直接更新     */    @RequestMapping(value = "update_information.do", method = RequestMethod.POST)    @ResponseBody    public ServerResponse<User> updateInformation(HttpSession session, User user) {        User currentUser = (User) session.getAttribute(Const.CURRENT_USER);        if(currentUser == null) {            return ServerResponse.createByErrorMessage("用户未登录");        }        //因为user放的更新信息，里面没有用户的id，所以要先放进去，这里也是为了防止越权        user.setId(currentUser.getId());        user.setUsername(currentUser.getUsername());        ServerResponse<User> response = iUserService.updateInformation(user);        if(response.isSuccess()) {            //成功则要更新session            session.setAttribute(Const.CURRENT_USER, response.getData());        }        //最后不管成功失败，直接返回就行        return response;    }    /**     * 获取用户信息     * 调用这个方法如果发现没有登录要强制登录     * @param session     * @return     */    @RequestMapping(value = "get_information.do", method = RequestMethod.POST)    @ResponseBody    public ServerResponse<User> getInformation(HttpSession session) {        User currentUser = (User) session.getAttribute(Const.CURRENT_USER);        if(currentUser == null) {            return ServerResponse.createByErrorCodeMessage(ResponseCode.NEED_LOGIN.getCode(), "未登录，需要强制登录status=10");        }        return iUserService.getInformation(currentUser.getId());    }}

同时也在common中新建了一个常量类，这里暂时只有一点内容，以后慢慢扩展。

package top.winxblast.happymall.common;/** * 常量类 * * @author winxblast * @create 2017/10/20 **/public class Const {    public static final String CURRENT_USER = "currentUser";    public static final String EMAIL = "email";    public static final String USERNAME = "username";     /**     * 这个分组如果使用枚举类可能显得比较重，这里用一个接口     * 接口不能包含实例域或静态方法，但可以包含常量     * 接口中的域将被自动设为 public static final     */    public interface Role{        int ROLE_CUSTOMER = 0; //普通用户        int ROLE_ADMIN = 1; //管理员    }}

用户service接口

对于上一小节注入controller的IUserService，这里给出接口的定义和实现类。controller调用service的接口，service接口实现类里面调用dao的接口进行数据库操作。

这里就是一个典型的先定义接口再实现类的实践，当然我自己还没能体会到这种方式的好处···

在service包下创建IUserService.java，这里接口名字还要添加大写“I”的习惯可能有些过时了，先按照老师的习惯写吧···

package top.winxblast.happymall.service;import top.winxblast.happymall.common.ServerResponse;import top.winxblast.happymall.pojo.User;/** * 前台用户接口设计 * 使用接口及接口实现，为以后的AOP做准备；无论在用静态代理还是动态代理包括后续发展 * 成的AOP，我们都用接口代理。类的代理扩展性没有接口强 * * @author winxblast * @create 2017/10/19 **/public interface IUserService {    ServerResponse<User> login(String username, String password);    ServerResponse<String> register(User user);    ServerResponse<String> checkValid(String str, String type);    ServerResponse<String> selectQuestion(String username);    ServerResponse<String> checkAnswer(String username, String question, String answer);    ServerResponse<String> forgetResetPassword(String username, String passwordNew, String forgetToken);    ServerResponse<String> resetPassword(User user, String passwordOld, String passwordNew);    ServerResponse<User> updateInformation(User user);    ServerResponse<User> getInformation(Integer userId);}

在service包下创建impl包，再创建UserServiceImpl.java

package top.winxblast.happymall.service.impl;import org.apache.commons.lang3.StringUtils;import org.springframework.beans.factory.annotation.Autowired;import org.springframework.stereotype.Service;import top.winxblast.happymall.common.Const;import top.winxblast.happymall.common.ServerResponse;import top.winxblast.happymall.common.TokenCache;import top.winxblast.happymall.dao.UserMapper;import top.winxblast.happymall.pojo.User;import top.winxblast.happymall.service.IUserService;import top.winxblast.happymall.util.MD5Util;import java.util.UUID;/** * 前台用户接口实现 * * @author winxblast * @create 2017/10/19 **///注意这个service的注解，名字改为接口的首字母小写，后续注入controller也是用这个名字@Service("iUserService")public class UserServiceImpl implements IUserService {    @Autowired    private UserMapper userMapper;    @Override    public ServerResponse<User> login(String username, String password) {        int resultCount = userMapper.checkUsername(username);        if(resultCount == 0) {            return ServerResponse.createByErrorMessage("用户名不存在");        }        //密码登录MD5        String md5Password = MD5Util.MD5EncodeUtf8(password);        User user = userMapper.selectLogin(username, md5Password);        if(user == null) {            //因为上面已经判断过有没有用户名了，所以这里就是密码错误            return ServerResponse.createByErrorMessage("密码错误");        }        //如果到这都没有return，则就是登录成功        user.setPassword(StringUtils.EMPTY);        return ServerResponse.createBySuccess("登录成功", user);    }    @Override    public ServerResponse<String> register(User user) {//        int resultCount = userMapper.checkUsername(user.getUsername());//        if(resultCount > 0) {//            return ServerResponse.createByErrorMessage("用户名已存在");//        }////        resultCount = userMapper.checkEmail(user.getEmail());//        if(resultCount > 0) {//            return ServerResponse.createByErrorMessage("email已存在");//        }        //根据下面的checkValid方法改造这段内容        ServerResponse validResponse = this.checkValid(user.getUsername(), Const.USERNAME);        if(!validResponse.isSuccess()) {            return validResponse;        }        validResponse = this.checkValid(user.getEmail(), Const.EMAIL);        if(!validResponse.isSuccess()) {            return validResponse;        }        user.setRole(Const.Role.ROLE_CUSTOMER);        //MD5加密，数据库中不能存储明文，这里的安全知识还涉及重放攻击等，这里是比较简单的设计        user.setPassword(MD5Util.MD5EncodeUtf8(user.getPassword()));        //mybatis的insert、delete、update默认返回操作的条数        int resultCount = userMapper.insert(user);        if(resultCount == 0) {            return ServerResponse.createByErrorMessage("注册失败");        }        return ServerResponse.createBySuccessMessage("注册成功");    }    /**     * 通过type是email还是username去调用不同的sql判断     * @param str     * @param type 同样也把type的值设置常量     * @return     */    @Override    public ServerResponse<String> checkValid(String str, String type) {        //注意isNotBlank和isNotEmpty的区别，请看源码        if(StringUtils.isNotBlank(type)) {            //type不空才开始校验            if(Const.USERNAME.equals(type)) {                int resultCount = userMapper.checkUsername(str);                if(resultCount > 0) {                    return ServerResponse.createByErrorMessage("用户名已存在");                }            }            if(Const.EMAIL.equals(type)) {                int resultCount = userMapper.checkEmail(str);                if(resultCount > 0) {                    return ServerResponse.createByErrorMessage("email已存在");                }            }        } else {            return ServerResponse.createByErrorMessage("参数错误");        }        return ServerResponse.createBySuccessMessage("校验成功");    }    /**     * 通过用户名获取密码找回问题     * @param username     * @return     */    @Override    public ServerResponse<String> selectQuestion(String username) {        ServerResponse validResponse = this.checkValid(username, Const.USERNAME);        if(validResponse.isSuccess()) {            //用户不存在            return ServerResponse.createByErrorMessage("用户不存在");        }        String question = userMapper.selectQuestionByUsername(username);        if(StringUtils.isNotBlank(question)) {            return ServerResponse.createBySuccess(question);        }        return ServerResponse.createByErrorMessage("找回密码的问题是空的");    }    /**     * 检查密码提示问题的答案是否正确     * @param username     * @param question     * @param answer     * @return     */    @Override    public ServerResponse<String> checkAnswer(String username, String question, String answer) {        int resultCount = userMapper.checkAnswer(username,question,answer);        if(resultCount > 0) {            //说明问题及问题答案是这个用户的，并且是正确的            //这个UUID类是java.util自带的类，可以生成一个重复概率非常非常低的字符串            String forgeToken = UUID.randomUUID().toString();            //然后需要把这个forgetToken放到cache中并设置有效期            TokenCache.setKey(TokenCache.TOKEN_PREFIX + username, forgeToken);            return ServerResponse.createBySuccess(forgeToken);        }        return ServerResponse.createByErrorMessage("问题的答案错误");    }    @Override    public ServerResponse<String> forgetResetPassword(String username, String passwordNew, String forgetToken) {        if(StringUtils.isBlank(forgetToken)) {            return ServerResponse.createByErrorMessage("参数错误，token需要传递");        }        ServerResponse validResponse = this.checkValid(username,Const.USERNAME);        if(validResponse.isSuccess()) {            return ServerResponse.createByErrorMessage("用户不存在");        }        String token = TokenCache.getKey(TokenCache.TOKEN_PREFIX + username);        if(StringUtils.isBlank(token)) {            return ServerResponse.createByErrorMessage("token无效或者过期");        }        if(StringUtils.equals(forgetToken, token)) {            //看了一些安全方面资料，这里的password应该已经是前端把密码加了固定盐值再MD5之后的内容了            //所以这里可能是有漏洞的，不应该在后端加密            //todo 修改加密的模式            String md5Password = MD5Util.MD5EncodeUtf8(passwordNew);            int rowCount = userMapper.updatePasswordByUsername(username,md5Password);            if(rowCount > 0) {                return ServerResponse.createBySuccessMessage("修改密码成功");            }        } else {            return ServerResponse.createByErrorMessage("token错误，请重新获取重置密码的token");        }        return ServerResponse.createByErrorMessage("修改密码失败");    }    @Override    public ServerResponse<String> resetPassword(User user, String passwordOld, String passwordNew) {        //防止横向越权，要校验一下这个用户的旧密码，且一定要指定是不是这个用户的，因为我们会查询一个count(1)，所以还是要全部核对一遍再修改        int resultCount = userMapper.checkPassword(user.getId(), MD5Util.MD5EncodeUtf8(passwordOld));        if(resultCount == 0) {            return ServerResponse.createByErrorMessage("旧密码错误");        }        user.setPassword(MD5Util.MD5EncodeUtf8(passwordNew));        int updateCount = userMapper.updateByPrimaryKeySelective(user);        if(updateCount > 0) {            return ServerResponse.createBySuccessMessage("密码更新成功");        }        return ServerResponse.createByErrorMessage("密码更新失败");    }    @Override    public ServerResponse<User> updateInformation(User user) {        //username是不能被更新的        //email也要进行一个校验，校验新的email是不是已经存在，并且存在的emai如果相同的话，不能是我们当前这个用户的        int resultCount = userMapper.checkEmailByUserId(user.getId(), user.getEmail());        if(resultCount > 0) {            return ServerResponse.createByErrorMessage("email已存在，请更换email再尝试更新");        }        //todo 这个项目的实例还是很简单的，包括手机号的验证等都没有写，等待扩展        User updateUser = new User();        updateUser.setId(user.getId());        updateUser.setUsername(user.getUsername());        updateUser.setEmail(user.getEmail());        updateUser.setPhone(user.getPhone());        updateUser.setQuestion(user.getQuestion());        updateUser.setAnswer(user.getAnswer());        int updateCount = userMapper.updateByPrimaryKeySelective(updateUser);        if(updateCount > 0) {            return ServerResponse.createBySuccess("更新个人信息成功", updateUser);        }        return ServerResponse.createByErrorMessage("更新个人信息失败");    }    @Override    public ServerResponse<User> getInformation(Integer userId) {        User user = userMapper.selectByPrimaryKey(userId);        if(user == null) {            return ServerResponse.createByErrorMessage("找不到当前用户");        }        //不能把密码传出去        user.setPassword(StringUtils.EMPTY);        return ServerResponse.createBySuccess(user);    }}

DAO部分

这里给出用户表相关接口，以及xml的配置，UserMapper.xml中没有mybatis generator注解的就是我后来自己加的

UserMapper.java

package top.winxblast.happymall.dao;import org.apache.ibatis.annotations.Param;import top.winxblast.happymall.pojo.User;public interface UserMapper {    /**     * This method was generated by MyBatis Generator.     * This method corresponds to the database table happymall_user     *     * @mbggenerated Sun Oct 08 14:03:47 CST 2017     */    int deleteByPrimaryKey(Integer id);    /**     * This method was generated by MyBatis Generator.     * This method corresponds to the database table happymall_user     *     * @mbggenerated Sun Oct 08 14:03:47 CST 2017     */    int insert(User record);    /**     * This method was generated by MyBatis Generator.     * This method corresponds to the database table happymall_user     *     * @mbggenerated Sun Oct 08 14:03:47 CST 2017     */    int insertSelective(User record);    /**     * This method was generated by MyBatis Generator.     * This method corresponds to the database table happymall_user     *     * @mbggenerated Sun Oct 08 14:03:47 CST 2017     */    User selectByPrimaryKey(Integer id);    /**     * This method was generated by MyBatis Generator.     * This method corresponds to the database table happymall_user     *     * @mbggenerated Sun Oct 08 14:03:47 CST 2017     */    int updateByPrimaryKeySelective(User record);    /**     * This method was generated by MyBatis Generator.     * This method corresponds to the database table happymall_user     *     * @mbggenerated Sun Oct 08 14:03:47 CST 2017     */    int updateByPrimaryKey(User record);    /**     * 通过用户名来查询数据库中是否存在用户     * @param username     * @return 用户数量     */    int checkUsername(String username);    /**     * 查看email是否已经被注册     * @param email     * @return     */    int checkEmail(String email);    /**     * 通过用户名和密码查看是否有这个用户     * mybatis在传递多个参数的时候需要用到param注解，写sql时就对应注解里的string     * @param username     * @param password     * @return     */    User selectLogin(@Param("username") String username, @Param("password") String password);    /**     * 通过用户名来获取密码提示问题     * @param username     * @return     */    String selectQuestionByUsername(String username);    /**     * 检查密码找回问题的答案是否正确     * 多个传入参数还是老规矩要使用@Param     * @param username     * @param question     * @param answer     * @return     */    int checkAnswer(@Param("username")String username, @Param("question")String question, @Param("answer")String answer);    /**     * 通过用户名修改密码     * @param username     * @param passwordNew     * @return     */    int updatePasswordByUsername(@Param("username")String username, @Param("passwordNew")String passwordNew);    /**     * 通过用户id验证密码是否正确，这个感觉跟selectLogin有点重复，只不过一个返回用户，     * 一个返回查询到的数量，可能取用户的多个字段性能会差一点，具体差多少有待试验     * @param userId     * @param password     * @return     */    int checkPassword(@Param("userId")Integer userId, @Param("password")String password);    /**     * 检查email地址是否有其他用户使用     * @param userId     * @param email     * @return 返回1，则email地址已被使用，返回0，则email未被使用     */    int checkEmailByUserId(@Param("userId")Integer userId, @Param("email")String email);}

UserMapper.xml
这里特别要注意一点就是sql函数count后面不要接空格···不然SQL会执行错误

<?xml version="1.0" encoding="UTF-8" ?><!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN" "http://mybatis.org/dtd/mybatis-3-mapper.dtd" ><mapper namespace="top.winxblast.happymall.dao.UserMapper" >  <resultMap id="BaseResultMap" type="top.winxblast.happymall.pojo.User" >    <!--      WARNING - @mbggenerated      This element is automatically generated by MyBatis Generator, do not modify.      This element was generated on Sun Oct 08 14:03:47 CST 2017.    -->    <constructor >      <idArg column="id" jdbcType="INTEGER" javaType="java.lang.Integer" />      <arg column="username" jdbcType="VARCHAR" javaType="java.lang.String" />      <arg column="password" jdbcType="VARCHAR" javaType="java.lang.String" />      <arg column="email" jdbcType="VARCHAR" javaType="java.lang.String" />      <arg column="phone" jdbcType="VARCHAR" javaType="java.lang.String" />      <arg column="question" jdbcType="VARCHAR" javaType="java.lang.String" />      <arg column="answer" jdbcType="VARCHAR" javaType="java.lang.String" />      <arg column="role" jdbcType="INTEGER" javaType="java.lang.Integer" />      <arg column="create_time" jdbcType="TIMESTAMP" javaType="java.util.Date" />      <arg column="update_time" jdbcType="TIMESTAMP" javaType="java.util.Date" />    </constructor>  </resultMap>  <sql id="Base_Column_List" >    <!--      WARNING - @mbggenerated      This element is automatically generated by MyBatis Generator, do not modify.      This element was generated on Sun Oct 08 14:03:47 CST 2017.    -->    id, username, password, email, phone, question, answer, role, create_time, update_time  </sql>  <select id="selectByPrimaryKey" resultMap="BaseResultMap" parameterType="java.lang.Integer" >    <!--      WARNING - @mbggenerated      This element is automatically generated by MyBatis Generator, do not modify.      This element was generated on Sun Oct 08 14:03:47 CST 2017.    -->    select     <include refid="Base_Column_List" />    from happymall_user    where id = #{id,jdbcType=INTEGER}  </select>  <delete id="deleteByPrimaryKey" parameterType="java.lang.Integer" >    <!--      WARNING - @mbggenerated      This element is automatically generated by MyBatis Generator, do not modify.      This element was generated on Sun Oct 08 14:03:47 CST 2017.    -->    delete from happymall_user    where id = #{id,jdbcType=INTEGER}  </delete>  <insert id="insert" parameterType="top.winxblast.happymall.pojo.User" >    <!--      WARNING - @mbggenerated      This element is automatically generated by MyBatis Generator, do not modify.      This element was generated on Sun Oct 08 14:03:47 CST 2017.    -->    insert into happymall_user (id, username, password,       email, phone, question,       answer, role, create_time,       update_time)    values (#{id,jdbcType=INTEGER}, #{username,jdbcType=VARCHAR}, #{password,jdbcType=VARCHAR},       #{email,jdbcType=VARCHAR}, #{phone,jdbcType=VARCHAR}, #{question,jdbcType=VARCHAR},       #{answer,jdbcType=VARCHAR}, #{role,jdbcType=INTEGER}, now(),      now())  </insert>  <insert id="insertSelective" parameterType="top.winxblast.happymall.pojo.User" >    <!--      WARNING - @mbggenerated      This element is automatically generated by MyBatis Generator, do not modify.      This element was generated on Sun Oct 08 14:03:47 CST 2017.    -->    insert into happymall_user    <trim prefix="(" suffix=")" suffixOverrides="," >      <if test="id != null" >        id,      </if>      <if test="username != null" >        username,      </if>      <if test="password != null" >        password,      </if>      <if test="email != null" >        email,      </if>      <if test="phone != null" >        phone,      </if>      <if test="question != null" >        question,      </if>      <if test="answer != null" >        answer,      </if>      <if test="role != null" >        role,      </if>      <if test="createTime != null" >        create_time,      </if>      <if test="updateTime != null" >        update_time,      </if>    </trim>    <trim prefix="values (" suffix=")" suffixOverrides="," >      <if test="id != null" >        #{id,jdbcType=INTEGER},      </if>      <if test="username != null" >        #{username,jdbcType=VARCHAR},      </if>      <if test="password != null" >        #{password,jdbcType=VARCHAR},      </if>      <if test="email != null" >        #{email,jdbcType=VARCHAR},      </if>      <if test="phone != null" >        #{phone,jdbcType=VARCHAR},      </if>      <if test="question != null" >        #{question,jdbcType=VARCHAR},      </if>      <if test="answer != null" >        #{answer,jdbcType=VARCHAR},      </if>      <if test="role != null" >        #{role,jdbcType=INTEGER},      </if>      <if test="createTime != null" >        now(),      </if>      <if test="updateTime != null" >        now(),      </if>    </trim>  </insert>  <update id="updateByPrimaryKeySelective" parameterType="top.winxblast.happymall.pojo.User" >    <!--      WARNING - @mbggenerated      This element is automatically generated by MyBatis Generator, do not modify.      This element was generated on Sun Oct 08 14:03:47 CST 2017.    -->    update happymall_user    <set >      <if test="username != null" >        username = #{username,jdbcType=VARCHAR},      </if>      <if test="password != null" >        password = #{password,jdbcType=VARCHAR},      </if>      <if test="email != null" >        email = #{email,jdbcType=VARCHAR},      </if>      <if test="phone != null" >        phone = #{phone,jdbcType=VARCHAR},      </if>      <if test="question != null" >        question = #{question,jdbcType=VARCHAR},      </if>      <if test="answer != null" >        answer = #{answer,jdbcType=VARCHAR},      </if>      <if test="role != null" >        role = #{role,jdbcType=INTEGER},      </if>      <if test="createTime != null" >        create_time = #{createTime,jdbcType=TIMESTAMP},      </if>      <if test="updateTime != null" >        update_time = now(),      </if>    </set>    where id = #{id,jdbcType=INTEGER}  </update>  <update id="updateByPrimaryKey" parameterType="top.winxblast.happymall.pojo.User" >    <!--      WARNING - @mbggenerated      This element is automatically generated by MyBatis Generator, do not modify.      This element was generated on Sun Oct 08 14:03:47 CST 2017.    -->    update happymall_user    set username = #{username,jdbcType=VARCHAR},      password = #{password,jdbcType=VARCHAR},      email = #{email,jdbcType=VARCHAR},      phone = #{phone,jdbcType=VARCHAR},      question = #{question,jdbcType=VARCHAR},      answer = #{answer,jdbcType=VARCHAR},      role = #{role,jdbcType=INTEGER},      create_time = #{createTime,jdbcType=TIMESTAMP},      update_time = now()    where id = #{id,jdbcType=INTEGER}  </update>  <select id="checkUsername" resultType="java.lang.Integer" parameterType="java.lang.String">    <!--#号是预编译，防止sql注入-->    SELECT COUNT(1) FROM happymall_user    WHERE username = #{username}  </select>  <select id="checkEmail" resultType="int" parameterType="string">    SELECT COUNT(1) FROM happymall_user    WHERE email = #{email}  </select>  <select id="selectLogin" resultMap="BaseResultMap" parameterType="map">    SELECT    <include refid="Base_Column_List"/>    FROM happymall_user    WHERE username = #{username}    AND password = #{password}  </select>  <select id="selectQuestionByUsername" resultType="string" parameterType="string">    SELECT    question    FROM happymall_user    WHERE username = #{username}  </select>  <select id="checkAnswer" resultType="int" parameterType="map">    SELECT    COUNT(1)    FROM happymall_user    WHERE username = #{username}    AND question = #{question}    AND answer = #{answer}  </select>  <update id="updatePasswordByUsername" parameterType="map">    UPDATE happymall_user    SET password = #{passwordNew}, update_time = now()    WHERE username = #{username}  </update>  <select id="checkPassword" resultType="int" parameterType="map">    SELECT COUNT(1)    FROM happymall_user    WHERE id = #{userId}    AND password = #{password}  </select>  <select id="checkEmailByUserId" resultType="int" parameterType="map">    <!--其实就是看看这个新的email是不是属于其他用户的-->    SELECT COUNT(1)    FROM happymall_user    WHERE email = #{email}    AND id != #{userId}  </select></mapper>

后台管理员用户

后台管理员在这里本质是和普通用户一样的，都在同一张user表中，只不过role字段不同而已，所以这里针对后台管理员用户只需要写controller层就行了，service层和dao层在功能够用的情况下完全可以不用重写。
血泪教训：RequestMapping不要用manager，会跟tomcat冲突，改用manage

package top.winxblast.happymall.controller.backend;import org.springframework.beans.factory.annotation.Autowired;import org.springframework.stereotype.Controller;import org.springframework.web.bind.annotation.RequestMapping;import org.springframework.web.bind.annotation.RequestMethod;import org.springframework.web.bind.annotation.ResponseBody;import top.winxblast.happymall.common.Const;import top.winxblast.happymall.common.ServerResponse;import top.winxblast.happymall.pojo.User;import top.winxblast.happymall.service.IUserService;import javax.servlet.http.HttpSession;/** * 后台管理员相关功能类，控制层 * * @author winxblast * @create 2017/10/22 **/@Controller//这里有个问题RequestMapping这里最好不要用manager，因为可能汇合tomcat自己的manager界面冲突，所以改为manage@RequestMapping("/manage/user")public class UserManageController {    @Autowired    private IUserService iUserService;    @RequestMapping(value = "/login.do", method = RequestMethod.POST)    @ResponseBody    public ServerResponse<User> login(String username, String password, HttpSession session) {        ServerResponse<User> response = iUserService.login(username, password);        if(response.isSuccess()) {            User user = response.getData();            if(user.getRole() == Const.Role.ROLE_ADMIN) {                //说明登录的是管理员                session.setAttribute(Const.CURRENT_USER, user);                return response;            } else {                return ServerResponse.createByErrorMessage("不是管理员，无法登录");            }        }        return response;    }}

小结（一些感想，想到啥说啥）

其实自己以前也没有接触过正规的开发内容，现在看来自己的习惯还是有很多要修改的，从上一篇的5-1先设计用户接口，再到这一篇的实现，就是一个比较规范的过程了。

这些规范就是代码质量，工程化的例子吧···（请原谅我简单的认识￣□￣｜｜）

对于哪些代码要放在controller层中，哪些放在service层中有了些模模糊糊的认识，以后还要多看看别人的代码~