diff --git a/src/main/java/com/alibaba/druid/mapping/MappingEngine.java b/src/main/java/com/alibaba/druid/mapping/MappingEngine.java
index 891b6c029c..93ba1fc324 100644
--- a/src/main/java/com/alibaba/druid/mapping/MappingEngine.java
+++ b/src/main/java/com/alibaba/druid/mapping/MappingEngine.java
@@ -9,7 +9,6 @@ import java.util.Map;
 
 import javax.sql.DataSource;
 
-import com.alibaba.druid.mapping.spi.ExportParameterVisitor;
 import com.alibaba.druid.mapping.spi.MappingProvider;
 import com.alibaba.druid.mapping.spi.MappingVisitor;
 import com.alibaba.druid.mapping.spi.MySqlMappingProvider;
@@ -18,6 +17,7 @@ import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement;
 import com.alibaba.druid.sql.ast.statement.SQLInsertStatement;
 import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock;
 import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement;
+import com.alibaba.druid.sql.visitor.ExportParameterVisitor;
 import com.alibaba.druid.sql.visitor.SQLASTOutputVisitor;
 import com.alibaba.druid.util.JdbcUtils;
 
diff --git a/src/main/java/com/alibaba/druid/mapping/spi/ExportParameterVisitor.java b/src/main/java/com/alibaba/druid/mapping/spi/ExportParameterVisitor.java
deleted file mode 100644
index 6095afdc55..0000000000
--- a/src/main/java/com/alibaba/druid/mapping/spi/ExportParameterVisitor.java
+++ /dev/null
@@ -1,8 +0,0 @@
-package com.alibaba.druid.mapping.spi;
-
-import com.alibaba.druid.sql.visitor.SQLASTVisitor;
-
-
-public interface ExportParameterVisitor extends SQLASTVisitor {
-    
-}
diff --git a/src/main/java/com/alibaba/druid/mapping/spi/MSSQLServerMappingProvider.java b/src/main/java/com/alibaba/druid/mapping/spi/MSSQLServerMappingProvider.java
index e9cf062113..be9ecc1d54 100644
--- a/src/main/java/com/alibaba/druid/mapping/spi/MSSQLServerMappingProvider.java
+++ b/src/main/java/com/alibaba/druid/mapping/spi/MSSQLServerMappingProvider.java
@@ -14,7 +14,9 @@ import com.alibaba.druid.sql.dialect.sqlserver.ast.SQLServerSelectQueryBlock;
 import com.alibaba.druid.sql.dialect.sqlserver.ast.Top;
 import com.alibaba.druid.sql.dialect.sqlserver.parser.SQLServerSelectParser;
 import com.alibaba.druid.sql.dialect.sqlserver.parser.SQLServerStatementParser;
+import com.alibaba.druid.sql.dialect.sqlserver.visitor.MSSQLServerExportParameterVisitor;
 import com.alibaba.druid.sql.dialect.sqlserver.visitor.SQLServerOutputVisitor;
+import com.alibaba.druid.sql.visitor.ExportParameterVisitor;
 import com.alibaba.druid.sql.visitor.SQLASTOutputVisitor;
 
 public class MSSQLServerMappingProvider implements MappingProvider {
diff --git a/src/main/java/com/alibaba/druid/mapping/spi/MappingProvider.java b/src/main/java/com/alibaba/druid/mapping/spi/MappingProvider.java
index 001ad11251..5fb76f3c86 100644
--- a/src/main/java/com/alibaba/druid/mapping/spi/MappingProvider.java
+++ b/src/main/java/com/alibaba/druid/mapping/spi/MappingProvider.java
@@ -7,6 +7,7 @@ import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement;
 import com.alibaba.druid.sql.ast.statement.SQLInsertStatement;
 import com.alibaba.druid.sql.ast.statement.SQLSelectQueryBlock;
 import com.alibaba.druid.sql.ast.statement.SQLUpdateStatement;
+import com.alibaba.druid.sql.visitor.ExportParameterVisitor;
 import com.alibaba.druid.sql.visitor.SQLASTOutputVisitor;
 
 public interface MappingProvider {
diff --git a/src/main/java/com/alibaba/druid/mapping/spi/MySqlMappingProvider.java b/src/main/java/com/alibaba/druid/mapping/spi/MySqlMappingProvider.java
index eb5a5add13..ca61d7b83d 100644
--- a/src/main/java/com/alibaba/druid/mapping/spi/MySqlMappingProvider.java
+++ b/src/main/java/com/alibaba/druid/mapping/spi/MySqlMappingProvider.java
@@ -13,7 +13,9 @@ import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock;
 import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock.Limit;
 import com.alibaba.druid.sql.dialect.mysql.parser.MySqlSelectParser;
 import com.alibaba.druid.sql.dialect.mysql.parser.MySqlStatementParser;
+import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlExportParameterVisitor;
 import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlOutputVisitor;
+import com.alibaba.druid.sql.visitor.ExportParameterVisitor;
 import com.alibaba.druid.sql.visitor.SQLASTOutputVisitor;
 
 public class MySqlMappingProvider implements MappingProvider {
diff --git a/src/main/java/com/alibaba/druid/mapping/spi/OracleMappingProvider.java b/src/main/java/com/alibaba/druid/mapping/spi/OracleMappingProvider.java
index c310fca5cf..5583f3ff51 100644
--- a/src/main/java/com/alibaba/druid/mapping/spi/OracleMappingProvider.java
+++ b/src/main/java/com/alibaba/druid/mapping/spi/OracleMappingProvider.java
@@ -10,7 +10,9 @@ import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleDeleteStatement;
 import com.alibaba.druid.sql.dialect.oracle.ast.stmt.OracleSelectQueryBlock;
 import com.alibaba.druid.sql.dialect.oracle.parser.OracleSelectParser;
 import com.alibaba.druid.sql.dialect.oracle.parser.OracleStatementParser;
+import com.alibaba.druid.sql.dialect.oracle.visitor.OracleExportParameterVisitor;
 import com.alibaba.druid.sql.dialect.oracle.visitor.OracleOutputVisitor;
+import com.alibaba.druid.sql.visitor.ExportParameterVisitor;
 import com.alibaba.druid.sql.visitor.SQLASTOutputVisitor;
 
 public class OracleMappingProvider implements MappingProvider {
diff --git a/src/main/java/com/alibaba/druid/mapping/spi/MySqlExportParameterVisitor.java b/src/main/java/com/alibaba/druid/sql/dialect/mysql/visitor/MySqlExportParameterVisitor.java
similarity index 88%
rename from src/main/java/com/alibaba/druid/mapping/spi/MySqlExportParameterVisitor.java
rename to src/main/java/com/alibaba/druid/sql/dialect/mysql/visitor/MySqlExportParameterVisitor.java
index 621ab6129b..b9d67df5a7 100644
--- a/src/main/java/com/alibaba/druid/mapping/spi/MySqlExportParameterVisitor.java
+++ b/src/main/java/com/alibaba/druid/sql/dialect/mysql/visitor/MySqlExportParameterVisitor.java
@@ -1,7 +1,8 @@
-package com.alibaba.druid.mapping.spi;
+package com.alibaba.druid.sql.dialect.mysql.visitor;
 
 import java.util.List;
 
+import com.alibaba.druid.mapping.spi.ExportParameterVisitorUtils;
 import com.alibaba.druid.sql.ast.SQLOrderBy;
 import com.alibaba.druid.sql.ast.expr.SQLBetweenExpr;
 import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
@@ -10,7 +11,7 @@ import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
 import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause;
 import com.alibaba.druid.sql.ast.statement.SQLSelectItem;
 import com.alibaba.druid.sql.dialect.mysql.ast.statement.MySqlSelectQueryBlock.Limit;
-import com.alibaba.druid.sql.dialect.mysql.visitor.MySqlASTVisitorAdapter;
+import com.alibaba.druid.sql.visitor.ExportParameterVisitor;
 
 public class MySqlExportParameterVisitor extends MySqlASTVisitorAdapter implements ExportParameterVisitor {
 
diff --git a/src/main/java/com/alibaba/druid/mapping/spi/OracleExportParameterVisitor.java b/src/main/java/com/alibaba/druid/sql/dialect/oracle/visitor/OracleExportParameterVisitor.java
similarity index 87%
rename from src/main/java/com/alibaba/druid/mapping/spi/OracleExportParameterVisitor.java
rename to src/main/java/com/alibaba/druid/sql/dialect/oracle/visitor/OracleExportParameterVisitor.java
index 7c6600b96e..9934764ac1 100644
--- a/src/main/java/com/alibaba/druid/mapping/spi/OracleExportParameterVisitor.java
+++ b/src/main/java/com/alibaba/druid/sql/dialect/oracle/visitor/OracleExportParameterVisitor.java
@@ -1,7 +1,8 @@
-package com.alibaba.druid.mapping.spi;
+package com.alibaba.druid.sql.dialect.oracle.visitor;
 
 import java.util.List;
 
+import com.alibaba.druid.mapping.spi.ExportParameterVisitorUtils;
 import com.alibaba.druid.sql.ast.SQLOrderBy;
 import com.alibaba.druid.sql.ast.expr.SQLBetweenExpr;
 import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
@@ -9,7 +10,7 @@ import com.alibaba.druid.sql.ast.expr.SQLInListExpr;
 import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
 import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause;
 import com.alibaba.druid.sql.ast.statement.SQLSelectItem;
-import com.alibaba.druid.sql.dialect.oracle.visitor.OracleASTVIsitorAdapter;
+import com.alibaba.druid.sql.visitor.ExportParameterVisitor;
 
 public class OracleExportParameterVisitor extends OracleASTVIsitorAdapter implements ExportParameterVisitor {
 
diff --git a/src/main/java/com/alibaba/druid/mapping/spi/MSSQLServerExportParameterVisitor.java b/src/main/java/com/alibaba/druid/sql/dialect/sqlserver/visitor/MSSQLServerExportParameterVisitor.java
similarity index 87%
rename from src/main/java/com/alibaba/druid/mapping/spi/MSSQLServerExportParameterVisitor.java
rename to src/main/java/com/alibaba/druid/sql/dialect/sqlserver/visitor/MSSQLServerExportParameterVisitor.java
index 933ceaaeb6..7f3e5b1928 100644
--- a/src/main/java/com/alibaba/druid/mapping/spi/MSSQLServerExportParameterVisitor.java
+++ b/src/main/java/com/alibaba/druid/sql/dialect/sqlserver/visitor/MSSQLServerExportParameterVisitor.java
@@ -1,7 +1,8 @@
-package com.alibaba.druid.mapping.spi;
+package com.alibaba.druid.sql.dialect.sqlserver.visitor;
 
 import java.util.List;
 
+import com.alibaba.druid.mapping.spi.ExportParameterVisitorUtils;
 import com.alibaba.druid.sql.ast.SQLOrderBy;
 import com.alibaba.druid.sql.ast.expr.SQLBetweenExpr;
 import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
@@ -9,7 +10,7 @@ import com.alibaba.druid.sql.ast.expr.SQLInListExpr;
 import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
 import com.alibaba.druid.sql.ast.statement.SQLSelectGroupByClause;
 import com.alibaba.druid.sql.ast.statement.SQLSelectItem;
-import com.alibaba.druid.sql.dialect.sqlserver.visitor.SQLServerASTVisitorAdapter;
+import com.alibaba.druid.sql.visitor.ExportParameterVisitor;
 
 public class MSSQLServerExportParameterVisitor extends SQLServerASTVisitorAdapter implements ExportParameterVisitor {
 
diff --git a/src/main/java/com/alibaba/druid/sql/visitor/ExportParameterVisitor.java b/src/main/java/com/alibaba/druid/sql/visitor/ExportParameterVisitor.java
new file mode 100644
index 0000000000..9a88085147
--- /dev/null
+++ b/src/main/java/com/alibaba/druid/sql/visitor/ExportParameterVisitor.java
@@ -0,0 +1,6 @@
+package com.alibaba.druid.sql.visitor;
+
+
+public interface ExportParameterVisitor extends SQLASTVisitor {
+
+}
diff --git a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java
index 85069db23a..94f62cdd66 100644
--- a/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java
+++ b/src/main/java/com/alibaba/druid/wall/spi/MySqlWallVisitor.java
@@ -8,6 +8,7 @@ import com.alibaba.druid.sql.ast.SQLName;
 import com.alibaba.druid.sql.ast.SQLObject;
 import com.alibaba.druid.sql.ast.SQLStatement;
 import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
+import com.alibaba.druid.sql.ast.expr.SQLInListExpr;
 import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
 import com.alibaba.druid.sql.ast.expr.SQLNumericLiteralExpr;
 import com.alibaba.druid.sql.ast.expr.SQLPropertyExpr;
@@ -55,6 +56,11 @@ public class MySqlWallVisitor extends MySqlASTVisitorAdapter implements WallVisi
         WallVisitorUtils.check(this, x);
         return true;
     }
+    
+    public boolean visit(SQLInListExpr x) {
+        WallVisitorUtils.check(this, x);
+        return true;
+    }
 
     public boolean visit(SQLBinaryOpExpr x) {
         WallVisitorUtils.check(this, x);
diff --git a/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java
index 45769faf86..661d71a1a2 100644
--- a/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java
+++ b/src/main/java/com/alibaba/druid/wall/spi/OracleWallVisitor.java
@@ -9,6 +9,7 @@ import com.alibaba.druid.sql.ast.SQLObject;
 import com.alibaba.druid.sql.ast.SQLStatement;
 import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
 import com.alibaba.druid.sql.ast.expr.SQLIdentifierExpr;
+import com.alibaba.druid.sql.ast.expr.SQLInListExpr;
 import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
 import com.alibaba.druid.sql.ast.expr.SQLPropertyExpr;
 import com.alibaba.druid.sql.ast.statement.SQLDeleteStatement;
@@ -64,6 +65,11 @@ public class OracleWallVisitor extends OracleASTVIsitorAdapter implements WallVi
         WallVisitorUtils.check(this, x);
         return true;
     }
+    
+    public boolean visit(SQLInListExpr x) {
+        WallVisitorUtils.check(this, x);
+        return true;
+    }
 
     public boolean visit(SQLBinaryOpExpr x) {
         WallVisitorUtils.check(this, x);
diff --git a/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java b/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java
index 60e51ee3bb..bbf9c49e05 100644
--- a/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java
+++ b/src/main/java/com/alibaba/druid/wall/spi/SQLServerWallVisitor.java
@@ -9,6 +9,7 @@ import com.alibaba.druid.sql.ast.SQLObject;
 import com.alibaba.druid.sql.ast.SQLStatement;
 import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
 import com.alibaba.druid.sql.ast.expr.SQLIdentifierExpr;
+import com.alibaba.druid.sql.ast.expr.SQLInListExpr;
 import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
 import com.alibaba.druid.sql.ast.expr.SQLPropertyExpr;
 import com.alibaba.druid.sql.ast.expr.SQLVariantRefExpr;
@@ -81,8 +82,12 @@ public class SQLServerWallVisitor extends SQLServerASTVisitorAdapter implements
         WallVisitorUtils.check(this, x);
         return true;
     }
+    
+    public boolean visit(SQLInListExpr x) {
+        WallVisitorUtils.check(this, x);
+        return true;
+    }
 
-    // executeQuery
     public boolean visit(SQLBinaryOpExpr x) {
         WallVisitorUtils.check(this, x);
         return true;
diff --git a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
index 5b4e436d6c..9692540426 100644
--- a/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
+++ b/src/main/java/com/alibaba/druid/wall/spi/WallVisitorUtils.java
@@ -19,6 +19,7 @@ import com.alibaba.druid.sql.ast.expr.SQLAllColumnExpr;
 import com.alibaba.druid.sql.ast.expr.SQLBinaryOpExpr;
 import com.alibaba.druid.sql.ast.expr.SQLBinaryOperator;
 import com.alibaba.druid.sql.ast.expr.SQLCharExpr;
+import com.alibaba.druid.sql.ast.expr.SQLInListExpr;
 import com.alibaba.druid.sql.ast.expr.SQLIntegerExpr;
 import com.alibaba.druid.sql.ast.expr.SQLMethodInvokeExpr;
 import com.alibaba.druid.sql.ast.expr.SQLNCharExpr;
@@ -48,16 +49,27 @@ public class WallVisitorUtils {
 
     private final static Log LOG = LogFactory.getLog(WallVisitorUtils.class);
 
+    public static void check(WallVisitor visitor, SQLInListExpr x) {
+        if (visitor.getConfig().isMustParameterized()) {
+            for (SQLExpr param : x.getTargetList()) {
+                if (getValue(param) != null) {
+                    visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
+                    break;
+                }
+            }
+        }
+    }
+
     public static void check(WallVisitor visitor, SQLBinaryOpExpr x) {
-        if (x.getOperator().isRelational()) {
+        if (x.getOperator().isRelational() && visitor.getConfig().isMustParameterized()) {
             if (x.getLeft() instanceof SQLName && getValue(x.getRight()) != null) {
-                visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));    
+                visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
             } else if (x.getRight() instanceof SQLName && getValue(x.getLeft()) != null) {
                 visitor.getViolations().add(new IllegalSQLObjectViolation(visitor.toSQL(x)));
             }
         }
     }
-    
+
     public static void check(WallVisitor visitor, SQLPropertyExpr x) {
         checkSchema(visitor, x.getOwner());
     }
@@ -321,17 +333,16 @@ public class WallVisitorUtils {
         if (x.getOperator() == SQLBinaryOperator.Concat) {
             return leftResult.toString() + rightResult.toString();
         }
-        
+
         if (x.getOperator() == SQLBinaryOperator.Add) {
             if (leftResult == null || rightResult == null) {
                 return null;
             }
-            
+
             if (leftResult instanceof String || rightResult instanceof String) {
                 return leftResult.toString() + rightResult.toString();
             }
-            
-            
+
             if (leftResult instanceof Number || rightResult instanceof Number) {
                 return add((Number) leftResult, (Number) rightResult);
             }
@@ -339,12 +350,12 @@ public class WallVisitorUtils {
 
         return null;
     }
-    
+
     private static Number add(Number a, Number b) {
         if (a instanceof BigDecimal) {
             return ((BigDecimal) a).add(new BigDecimal(b.toString()));
         }
-        
+
         return a.longValue() + b.longValue();
     }
 
diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MustParameterizedTest2.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MustParameterizedTest2.java
new file mode 100644
index 0000000000..4c9475f733
--- /dev/null
+++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MustParameterizedTest2.java
@@ -0,0 +1,28 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallConfig;
+import com.alibaba.druid.wall.WallUtils;
+
+public class MustParameterizedTest2 extends TestCase {
+
+    private String     sql    = "select * from t where id in (3, 5)";
+
+    private WallConfig config = new WallConfig();
+
+    protected void setUp() throws Exception {
+        config.setMustParameterized(true);
+    }
+
+    public void testMySql() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql(sql, config));
+    }
+
+    public void testORACLE() throws Exception {
+
+        Assert.assertFalse(WallUtils.isValidateOracle(sql, config));
+    }
+}
diff --git a/src/test/java/com/alibaba/druid/bvt/filter/wall/MustParameterizedTest3.java b/src/test/java/com/alibaba/druid/bvt/filter/wall/MustParameterizedTest3.java
new file mode 100644
index 0000000000..1e65c74cca
--- /dev/null
+++ b/src/test/java/com/alibaba/druid/bvt/filter/wall/MustParameterizedTest3.java
@@ -0,0 +1,28 @@
+package com.alibaba.druid.bvt.filter.wall;
+
+import junit.framework.TestCase;
+
+import org.junit.Assert;
+
+import com.alibaba.druid.wall.WallConfig;
+import com.alibaba.druid.wall.WallUtils;
+
+public class MustParameterizedTest3 extends TestCase {
+
+    private String     sql    = "select * from t where id not in (3, 5)";
+
+    private WallConfig config = new WallConfig();
+
+    protected void setUp() throws Exception {
+        config.setMustParameterized(true);
+    }
+
+    public void testMySql() throws Exception {
+        Assert.assertFalse(WallUtils.isValidateMySql(sql, config));
+    }
+
+    public void testORACLE() throws Exception {
+
+        Assert.assertFalse(WallUtils.isValidateOracle(sql, config));
+    }
+}