SQL injection of Ibatis

Today, the original Ibatis $ is so dangerous, if you use $, it is likely to be injected into SQL!!!

So:

Use: SELECT * from T_user where name like '% ' | | #name #| | ' %'

Disabled: SELECT * from T_user where name like '% ' | | $name $ ' | | ' %'

Explain:

The precompiled statement has been escaped with Oracle's special character single quotes. The single quotation mark is treated as the query content, not as a delimiter for the string.

Because SQL injection actually uses special character single quotes, SQL is generated in this format of or 1 = 1. Precompilation already handles single quotes, so you can prevent SQL injection