IBatis solves SQL Injection

(1) ibatis xml configuration: The following statements are simple escape names like '% $ name $ %'
 
(2) This will cause SQL Injection problems. For example, if the parameter name is passed into a single quotation mark ('), the generated SQL statement will be: name like' %'
 
(3) The solution is to use string connection to construct the SQL statement name like '%' | '# name #' | '%'
 
(4) In this way, all parameters are pre-compiled, so there will be no SQL Injection problems.
 
(5) # differences with $:
 
# Xxx # indicates that xxx is the property value. The key in the map or the attribute in your pojo object will be automatically enclosed by quotation marks, the SQL statement is like where xxx = 'xxx ';
 
$ Xxx $ concatenates xxx into your SQL statement as a string, such as order by topicId... order by # xxx # ibatis will translate it into order by 'topid' (this will report an error) statement to write this... order by $ xxx $ ibatis will translate it into order by topicId
 
Author: 2012 gogogo !!!!!!!!!