On the difference between # and $ in MyBatis and the methods to prevent SQL injection _java

The difference between # and $ in the MyBatis

1. #将传入的数据都当成一个字符串, a double quotation mark is added to the data that is automatically passed in. For example: ORDER by #user_id #, if the value passed in is 111, then the value that is parsed into SQL will be "111", and if the value passed is an ID, the SQL that is parsed is the order by "id".
　　
2. $ to display incoming data directly in SQL. For example, the order by $user _id$, if the value passed in is 111, then the value that is parsed into SQL is user_id, and if the value passed in is an ID, the parsed SQL is the order by ID.
　　
3. #方式能够很大程度防止sql注入.
　　
The 4.$ method does not prevent SQL injection.

5.$ methods are typically used to pass in database objects, such as incoming table names.
　　
6. The general can use the # is not to use $.

Prevent SQL injection

NOTE: SQL statements are not written as SELECT * from T_stu where s_name like '% $name $% ', which is extremely susceptible to injection attacks.

Parameters in the format "${xxx}" are directly involved in SQL compilation, thus preventing injection attacks. However, when it comes to dynamic table names and column names, you can only use parameter formats such as "${xxx}".

When writing a mybatis mapping statement, try to use the format "#{xxx}" as much as possible. If you have to use parameters such as "${xxx}", do the filtering work manually to prevent SQL injection attacks.

Example

<sql id= "Condition_where" >  
  <isnotempty property= "CompanyName" prepend= "and" >  
    t1.company_name Like #companyName #  
  </isNotEmpty>  

Java code is similar to your original, in fact, there is no bad, you have to feel the trouble to judge null and '% ' encapsulated in a method can be

if (! Stringutil.isempty (This.companyname)) {  
  table.setcompanyname ("%" + this.companyname + "%");  

The above is a small series for everyone to talk about the difference between the # and $ in MyBatis and the method of preventing SQL injection all content, I hope that we support cloud Habitat Community ~