mybatis中#{}和${}的区别

发布时间：2020-05-22 17:54:53 所属栏目：MySql 来源：互联网

导读：mybatis本身的说明：String SubstitutionBy default, using the #{} syntax will cause MyBatis to generate PreparedStatement properties and set the values safely against the PreparedStatement parameters (e.g. ?). While this is safer, faster and

mybatis本身的说明：

By default,using the #{} syntax will cause MyBatis to generate PreparedStatement properties and set the values safely against the PreparedStatement parameters (e.g. ?). While this is safer,faster and almost always preferred,sometimes you just want to directly inject a string unmodified into the SQL Statement. For example,for ORDER BY,<span style="color: #000000;"> you might use something like this:

ORDER BY ${columnName}
Here MyBatis won't modify or escape the string.

NOTE It's not safe to accept input from a user and supply it to a statement unmodified in this way. This leads to potential SQL Injection attacks and therefore you should either disallow user input in these fields,or always perform your own escapes and checks.

从上文可以看出：

1. 使用#{}格式的语法在mybatis中使用Preparement语句来安全的设置值，执行sql类似下面的：

PreparedStatement ps =1,id);

此时MyBatis 不会修改或转义字符串。

这种方式类似于：

Statement st = ResultSet rs </span>= st.executeQuery(sql);</pre>

参考文献：

【1】http://mybatis.github.io/mybatis-3/sqlmap-xml.html

【2】https://mybatis.github.io/mybatis-3/zh/sqlmap-xml.html

（编辑：安卓应用网）

【声明】本站内容均来自网络，其相关言论仅代表作者个人观点，不代表本站立场。若无意侵犯到您的权利，请及时与联系站长删除相关内容!