如何正确使用UNNEST而不会受到sql注入的攻击

String sql = "SELECT * FROM table WHERE column IN UNNEST(?)";
PreparedStatement stmt = connection.prepareStatement(sql);
stmt.setArray(1, connection.createArrayOf("VARCHAR", yourArray));
ResultSet rs = stmt.executeQuery();

if (isValidArray(yourArray)) {
    // 执行查询
} else {
    // 报错或进行其他处理
}

validValues = ['value1', 'value2', 'value3']
userInput = ['value1', 'value2', 'value4']
filteredInput = [value for value in userInput if value in validValues]
if len(filteredInput) > 0:
    sql = "SELECT * FROM table WHERE column IN UNNEST(%s)"
    cursor.execute(sql, (filteredInput,))