1、${}拼串进行模糊查询，不安全

示例代码：

接口定义：

package com.mybatis.dao;

        import com.mybatis.bean.Employee;

        import java.util.List;

public interface EmployeeMapper {

    public List<Employee> getEmpsTestInnerParameter(Employee employee);

}

mapper定义：

<?xml version="1.0" encoding="UTF-8" ?>

<!DOCTYPE mapper

        PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"

        "http://mybatis.org/dtd/mybatis-3-mapper.dtd">

<mapper namespace="com.mybatis.dao.EmployeeMapper">

    <select id="getEmpsTestInnerParameter" resultType="com.mybatis.bean.Employee">

        <if test="_databaseId=='mysql'">

            select * from tbl_employee

            <if test="_parameter!=null">

                <!--模糊查询，${}可以进行拼串，但是这种方式不安全-->

                where last_name like '%${lastName}%'

            </if>

        </if>

        <if test="_databaseId=='oracle'">

            select * from employees

            <if test="_parameter!=null">

                where last_name = #{_parameter.lastName}

            </if>

        </if>

    </select>

</mapper>

测试代码：

package com.mybatis.demo;

import com.mybatis.bean.Department;

import com.mybatis.bean.Employee;

import com.mybatis.dao.EmployeeMapper;

import org.apache.ibatis.io.Resources;

import org.apache.ibatis.session.SqlSession;

import org.apache.ibatis.session.SqlSessionFactory;

import org.apache.ibatis.session.SqlSessionFactoryBuilder;

import org.junit.Test;

import java.io.IOException;

import java.io.InputStream;

import java.util.ArrayList;

import java.util.List;

public class MyTest {

    public SqlSessionFactory getSqlSessionFactory() throws IOException {

        String resource = "mybatis-config.xml";

        InputStream inputStream = Resources.getResourceAsStream(resource);

        return new SqlSessionFactoryBuilder().build(inputStream);

    }

    @Test

    public void test() throws IOException {

        SqlSessionFactory sqlSessionFactory = getSqlSessionFactory();

        SqlSession openSession = sqlSessionFactory.openSession(true);

        try {

            EmployeeMapper mapper = openSession.getMapper(EmployeeMapper.class);

            Employee employee = new Employee("e");

            List<Employee> list = mapper.getEmpsTestInnerParameter(employee);

            for (Employee emp : list) {

                System.out.println(emp);

            }

        } finally {

            openSession.close();

        }

    }

}

2、使用bind标签进行模糊查询

示例代码一：

接口定义：

package com.mybatis.dao;

import com.mybatis.bean.Employee;

import java.util.List;

public interface EmployeeMapper {

    public List<Employee> getEmpsTestInnerParameter(Employee employee);

}

mapper定义：

<?xml version="1.0" encoding="UTF-8" ?>

<!DOCTYPE mapper

        PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"

        "http://mybatis.org/dtd/mybatis-3-mapper.dtd">

<mapper namespace="com.mybatis.dao.EmployeeMapper">

    <select id="getEmpsTestInnerParameter" resultType="com.mybatis.bean.Employee">

        <!-- bind：可以将OGNL表达式的值绑定到一个变量中，方便后来引用这个变量的值 -->

        <bind name="_lastName" value="'%'+lastName+'%'"/>

        <if test="_databaseId=='mysql'">

            select * from tbl_employee

            <if test="_parameter!=null">

                where last_name like #{_lastName}

            </if>

        </if>

        <if test="_databaseId=='oracle'">

            select * from employees

            <if test="_parameter!=null">

                where last_name = #{_parameter.lastName}

            </if>

        </if>

    </select>

</mapper>

测试代码：

package com.mybatis.demo;

import com.mybatis.bean.Department;

import com.mybatis.bean.Employee;

import com.mybatis.dao.EmployeeMapper;

import org.apache.ibatis.io.Resources;

import org.apache.ibatis.session.SqlSession;

import org.apache.ibatis.session.SqlSessionFactory;

import org.apache.ibatis.session.SqlSessionFactoryBuilder;

import org.junit.Test;

import java.io.IOException;

import java.io.InputStream;

import java.util.ArrayList;

import java.util.List;

public class MyTest {

    public SqlSessionFactory getSqlSessionFactory() throws IOException {

        String resource = "mybatis-config.xml";

        InputStream inputStream = Resources.getResourceAsStream(resource);

        return new SqlSessionFactoryBuilder().build(inputStream);

    }

    @Test

    public void test() throws IOException {

        SqlSessionFactory sqlSessionFactory = getSqlSessionFactory();

        SqlSession openSession = sqlSessionFactory.openSession(true);

        try {

            EmployeeMapper mapper = openSession.getMapper(EmployeeMapper.class);

            Employee employee = new Employee("e");

            List<Employee> list = mapper.getEmpsTestInnerParameter(employee);

            for (Employee emp : list) {

                System.out.println(emp);

            }

        } finally {

            openSession.close();

        }

    }

}

示例代码二：

接口定义：

package com.mybatis.dao;

import com.mybatis.bean.Employee;

import java.util.List;

public interface EmployeeMapper {

    public List<Employee> getEmpsTestInnerParameter(Employee employee);

}

mapper定义：

<?xml version="1.0" encoding="UTF-8" ?>

<!DOCTYPE mapper

        PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"

        "http://mybatis.org/dtd/mybatis-3-mapper.dtd">

<mapper namespace="com.mybatis.dao.EmployeeMapper">

    <select id="getEmpsTestInnerParameter" resultType="com.mybatis.bean.Employee">

        <!-- bind：可以将OGNL表达式的值绑定到一个变量中，方便后来引用这个变量的值 -->

        <!--_代表任意一个字符-->

        <bind name="_lastName" value="'_'+lastName+'%'"/>

        <if test="_databaseId=='mysql'">

            select * from tbl_employee

            <if test="_parameter!=null">

                where last_name like #{_lastName}

            </if>

        </if>

        <if test="_databaseId=='oracle'">

            select * from employees

            <if test="_parameter!=null">

                where last_name = #{_parameter.lastName}

            </if>

        </if>

    </select>

</mapper>

测试代码：

package com.mybatis.demo;

import com.mybatis.bean.Department;

import com.mybatis.bean.Employee;

import com.mybatis.dao.EmployeeMapper;

import org.apache.ibatis.io.Resources;

import org.apache.ibatis.session.SqlSession;

import org.apache.ibatis.session.SqlSessionFactory;

import org.apache.ibatis.session.SqlSessionFactoryBuilder;

import org.junit.Test;

import java.io.IOException;

import java.io.InputStream;

import java.util.ArrayList;

import java.util.List;

public class MyTest {

    public SqlSessionFactory getSqlSessionFactory() throws IOException {

        String resource = "mybatis-config.xml";

        InputStream inputStream = Resources.getResourceAsStream(resource);

        return new SqlSessionFactoryBuilder().build(inputStream);

    }

    @Test

    public void test() throws IOException {

        SqlSessionFactory sqlSessionFactory = getSqlSessionFactory();

        SqlSession openSession = sqlSessionFactory.openSession(true);

        try {

            EmployeeMapper mapper = openSession.getMapper(EmployeeMapper.class);

            Employee employee = new Employee("i");

            List<Employee> list = mapper.getEmpsTestInnerParameter(employee);

            for (Employee emp : list) {

                System.out.println(emp);

            }

        } finally {

            openSession.close();

        }

    }

}

最新文章

  1. canvas ：曲线的面积图 加渐变效果
  2. intellij idea 插件 ideaVim 用法
  3. [转贴]关于C++的抽象的一点新认识
  4. nyoj 102 次方求模【快速幂】
  5. oracle中使用minus进行数据排除(类似SqlServer except函数)
  6. 【性能测试】【Jmeter】学习（1）
  7. 编译安装zabbix
  8. [WebGL入门]十六，绘制多个模型
  9. 图片拉伸iOS
  10. 三续ASM
  11. 使用MSBuild Tools调用csproj项目文件发布网站时$(SolutionDir)宏参数值丢失为空的解决方案
  12. linux基础之CentOS7新特性
  13. 题解-PKUWC2018 随机游走
  14. jquery改变字符串中部分字符的颜色
  15. 20165327 2017-2018-2 《Java程序设计》第8周学习总结
  16. 检查nginx后端real server脚本，实现发现宕机剔除，恢复服务自动加入功能
  17. css笔记 - transform学习笔记(二)
  18. HADOOP百度云资料
  19. maven install时报错 Failed to execute goal org.apache.maven.plugins:maven-surefire-plugin:2.12.4:test (default-test)
  20. [javaSE] IO流（递归查找指定文件）

热门文章

  1. Luogu 1450 [HAOI2008]硬币购物
  2. scau 2015寒假训练
  3. 3.3PCL已有点类型介绍和增加自定义的点类型
  4. WordCount编码和测试
  5. 开启wifi后不能ping通本机 Cann&#39;t ping the local PC while start a wlan
  6. git命令（一）
  7. 重建freescale 4.6.2 multilib toolchain
  8. EXTJs前后台交互 常用哦3种方式
  9. Hystrix线程隔离技术解析-线程池(转)
  10. pf4j实例 插件框架