By default, using the #{} syntax will cause MyBatis to generate PreparedStatement properties and set the values safely against the PreparedStatement parameters (e.g. ?). While this is safer, faster and almost always preferred, sometimes you just want to directly inject a string unmodified into the SQL Statement. For example, for ORDER BY, you might use something like this:
ORDER BY ${columnName} Here MyBatis won’t modify or escape the string.
NOTE It’s not safe to accept input from a user and supply it to a statement unmodified in this way. This leads to potential SQL Injection attacks and therefore you should either disallow user input in these fields, or always perform your own escapes and checks.
<selectid="selectByPrimaryKey"resultMap="BaseResultMap"parameterType="java.lang.Integer" > select <includerefid="Base_Column_List" /> from base.tb_user where id = #{id,jdbcType=INTEGER} </select>
intupdateByExample(@Param("user") User user, @Param("example") UserExample example);
sql映射:
1 2 3 4 5 6 7
<updateid="updateByExample"parameterType="map" > update tb_user set id = #{user.id,jdbcType=INTEGER}, ... <iftest="_parameter != null" > <includerefid="Update_By_Example_Where_Clause" /> </if>
注意这里测试传递进来的map是否为空,仍然使用_parameter
集合类型
You can pass a List instance or an Array to MyBatis as a parameter object. When you do, MyBatis will automatically wrap it in a Map, and key it by name. List instances will be keyed to the name “list” and array instances will be keyed to the name “array”.
<selectid="selectUserInList"resultType="User"> SELECT * FROM USER WHERE ID in <foreachitem="item"index="index"collection="list" open="("separator=","close=")"> #{item} </foreach> </select>