mybatis中$和#的用法区别
mybatis中$和#的用法区别
月亮叼飞机 发表于2年前
mybatis中$和#的用法区别
  • 发表于 2年前
  • 阅读 19
  • 收藏 0
  • 点赞 2
  • 评论 0

标题:腾讯云 新注册用户域名抢购1元起>>>   

项目中拼接了一个字符串作为sql not in的条件,但是用#起不到作用,

跟踪日志发现

#的话sql中为?,采用的是preparedStatement的方式

$的话sql中为直接参数连接起来



String Substitution By default, using the #{} syntax will cause MyBatis to generate PreparedStatement properties and set the values safely against the PreparedStatement parameters (e.g. ?).

 While this is safer, faster and almost always preferred, sometimes you just want to directly inject a string unmodified into the SQL Statement.

For example, for ORDER BY, you might use something like this: ORDER BY ${columnName} Here MyBatis won't modify or escape the string.

NOTE It's not safe to accept input from a user and supply it to a statement unmodified in this way. This leads to potential SQL Injection attacks and therefore you should either disallow user input in these fields, or always perform your own escapes and checks.







共有 人打赏支持
粉丝 0
博文 7
码字总数 2386
×
月亮叼飞机
如果觉得我的文章对您有用,请随意打赏。您的支持将鼓励我继续创作!
* 金额(元)
¥1 ¥5 ¥10 ¥20 其他金额
打赏人
留言
* 支付类型
微信扫码支付
打赏金额:
已支付成功
打赏金额: