MyBatis How to prevent SQL injection

SQL injection

What is SQL injection? First of all, SQL injection is an attack method, a malicious SQL statement is used to deceive the server to execute SQL commands, the database in the background to parse, so as to reach the target network, access to sensitive information attack means.

MyBatis How to prevent SQL injection in SQL # and $ differences

#	$
Equivalent to double quotation marks on the data	Equivalent to displaying data directly
Prevent SQL injection to a large extent	Cannot prevent SQL injection
#{xxx}, using the PreparedStatement, there will be type conversion, more secure	${XXX}, using string concatenation, easy SQL injection

simply put, #{} is pre-compiled, is secure,${} is not precompiled, just takes the value of the variable, is non-secure, there is SQL injection.

Example

1<select id= "Selectbackgoodsdetail" resulttype= "Java.util.Map" >2 SELECT sum (a.item_num) Backgoodsnum,a.item_price Backgoodsprice,3SUM (A.item_num *a.item_price) Backgoodssumprice,4 b.barcode,b.name itemname,b.weight,c.name itemcategoryname5 From Back_goods_detail a6Left JOIN item B on a.item_id=b.id7Left JOIN item_category C on b.item_category_id =c.id8<where>9<iftest= "Backgoodsid!=null" >Tena.back_goods_id =#{backgoodsid} One</if> A<iftest= "Itemcategoryid!=null" > -and b.item_category_id =#{itemcategoryid} -</if> the<ifTest= "searchkey!= null" > -and (B.sequence like CONCAT ('% ', #{searchkey}, '% ') -OR b.name like CONCAT ('% ', #{searchkey}, '% ') -OR b.barcode like CONCAT ('% ', #{searchkey}, '% ')) +</if> -</where> + GROUP by a.item_id A LIMIT #{pagestart},#{pagenum} at</select>

MyBatis How to prevent SQL injection