基于mybatis的CRUD
- u 基于Mybatis的CRUD
- u 掌握MyBatis的结果类型-resultMap和resultType
- u 掌握MyBatis的参数类型
- u 掌握#和$两种语法
1 基于mybatis的CRUD
1.1 StudentDAO
public interface StudentDao {
public void insertStudent(Student s);
public void updateStudent(Student s);
public void deleteStudent(String stuid);
public Student selectStudentById(String stuid);
public List<Student> selectStudent();
}
1.1 StudentDaoImpl
package cn.mybatis.dao.impl; import java.util.ArrayList;
import java.util.List; import org.apache.ibatis.session.SqlSession;
import org.apache.ibatis.session.SqlSessionFactory; import cn.mybatis.dao.StudentDao;
import cn.mybatis.domain.Student; public class StudentDaoImpl implements StudentDao{
private SqlSessionFactory fac;
public StudentDaoImpl(SqlSessionFactory fac){
this.fac = fac;
}
@Override
public void insertStudent(Student s) {
SqlSession sess = null;
try{
sess = this.fac.openSession();
sess.insert("student.insertStudent", s);
sess.commit();
}catch(Exception e){
e.printStackTrace();
}finally{
sess.close();
}
}
@Override
public void updateStudent(Student s) {
SqlSession sess = null;
try{
sess = this.fac.openSession();
sess.update("student.updateStudent", s);
sess.commit();
}catch(Exception e){
e.printStackTrace();
}finally{
sess.close();
}
} @Override
public void deleteStudent(String stuid) {
SqlSession sess = null;
try{
sess = this.fac.openSession();
sess.delete("student.deleteStudent", stuid);
sess.commit();
}catch(Exception e){
e.printStackTrace();
}finally{
sess.close();
}
} @Override
public Student selectStudentById(String stuid) {
SqlSession sess = null;
Student s = new Student();
try{
sess = this.fac.openSession();
s = sess.selectOne("student.selectStudentById", stuid);
sess.commit();
}catch(Exception e){
e.printStackTrace();
}finally{
sess.close();
}
return s;
}
@Override
public List<Student> selectStudent() {
SqlSession sess = null;
List<Student> sList = new ArrayList<Student>();
try{
sess = this.fac.openSession();
sList = sess.selectList("student.selectStudent");
sess.commit();
}catch(Exception e){
e.printStackTrace();
}finally{
sess.close();
}
return sList;
} }
1.1 StudentMapper.xml
<?xml version="1.0" encoding="UTF-8" ?>
<!DOCTYPE mapper PUBLIC "-//mybatis.org//DTD Mapper 3.0//EN"
"http://mybatis.org/dtd/mybatis-3-mapper.dtd">
<mapper namespace="student">
<resultMap type="student" id="BaseResultMap">
<id column="stu_id" property="stuId" jdbcType="VARCHAR" javaType="java.lang.String" />
<result column="stu_name" property="stuName" jdbcType="VARCHAR" javaType="java.lang.String" />
<result column="stu_birthdate" property="stuBirthdate" jdbcType="DATE" javaType="java.util.Date" />
<result column="stu_phone" property="stuPhone" jdbcType="VARCHAR" javaType="java.lang.String" />
</resultMap> <!-- 插入数据 -->
<insert id="insertStudent" parameterType="student">
insert into student (stu_id,stu_name,stu_birthdate,stu_phone)
values(#{stuId},#{stuName},#{stuBirthdate},#{stuPhone})
</insert> <!-- 更新数据 -->
<update id="updateStudent" parameterType="student">
update student set stu_name=#{stuName}, stu_birthdate=#{stuBirthdate},
stu_phone=#{stuPhone} where stu_id=#{stuId}
</update>
<!-- 删除数据 -->
<delete id="deleteStudent" parameterType="string">
delete from student where stu_id=#{stuId}
</delete> <!-- 查询数据,返回的数据会根据resultMap设置封装到实体类对象中 -->
<select id="selectStudentById" resultMap="BaseResultMap" parameterType="string" >
select * from student where stu_id=#{stuId}
</select> <select id="selectStudent" resultMap="BaseResultMap">
select * from student
</select>
</mapper>
1.1 测试demo
package cn.mybatis.demo;
……
public class Demo_01 {
private static SqlSessionFactory fac;
static{
InputStream is = null;
try{
//处理并根据config配置文件实例化SqlSessionFactory
is = Resources.getResourceAsStream("SqlMapperConfig.xml");
//获取session工厂类
fac = new SqlSessionFactoryBuilder().build(is);
}catch(Exception e){
e.printStackTrace();
Logger.getLogger(Demo_01.class).debug(e.getMessage());
}
} public static void main(String[] args) throws Exception {
//创建要保存的学生信息
Student s = new Student();
s.setStuId("1");
s.setStuName("zhouyeqin");
s.setStuBirthdate(new SimpleDateFormat("yyyy-MM-dd").parse("1990-1-12"));
s.setStuPhone("341324123"); StudentDao sdao = new StudentDaoImpl(fac);
//插入数据
// sdao.insertStudent(s);
//更新数据
// sdao.updateStudent(s);
//删除数据
// sdao.deleteStudent("1");
//根据id查询数据
// Student s1 = sdao.selectStudentById("1");
// System.out.println(s1);
//查询所有数据
// List<Student> s2 = sdao.selectStudent();
// System.out.println(s2);
}
}
2 MyBatis的结果类型-resultMap和resultType
<select>元素的返回值设置有两个常用属性:
- resultMap
属性值是已经定义好的<resultMap>元素的id
示例:
<resultMap id="BaseResultMap" type="com.icss.MyBatis.pojo.Student">
<select id="query" resultMap="BaseResultMap">
- resultType
属性值有以下情况:
- 单一类型,例如<select id="getCount" resultType="java.lang.Integer">
- 组合类型,一般都是pojo类,需要注意查询语句的列名或别名必须要和pojo类的属性名称一致,否则无法映射,例如<select id="query2" resultType="com.icss.MyBatis.pojo.Student">
- Map类型,列值会自动封装为键值对Map集合,键为列名,值为列值,例如<select id="query3" resultType="java.util.HashMap">
resultMap使用情况:
<!-- 查询单条 -->
<select id="queryById" resultMap="BaseResultMap" parameterType="java.lang.Integer" >
select * from student where stu_id=#{stuId}
</select>
<!-- 查询多条 -->
<select id="query" resultMap="BaseResultMap">
select * from student
</select>
resultType使用情况:
studentMapper.xml
<!-- 返回总记录数 -->
<select id="getCount" resultType="java.lang.Integer">
select count(*) from student
</select> <!-- 查询多条,返回类型为pojo类型,前提是列名(别名)必须和pojo类属性名称一致 -->
<select id="query2" resultType="cn.mybatis.domain.Student">
SELECT s.stu_id AS stuId,s.stu_name AS stuName,
s.stu_birthdate AS stuBirthdate,s.stu_phone AS stuPhone
FROM student s
</select> <!-- 查询多条,返回类型为List<Map>类型 -->
<select id="query3" resultType="java.util.HashMap">
select * from student
</select>
StudentDao.java
public void testGetCount();
public void testQuery2();
public void testQuery3();
StudentDaoImpl.java
@Override
public void testGetCount() {
SqlSession session = fac.openSession();
Integer count = (Integer) session.selectOne("student.getCount");
System.out.println("count=" + count);
session.close();
} @Override
public void testQuery2() {
SqlSession session = fac.openSession();
List<Student> list = session.selectList("student.query2");
for (Student stu : list) {
System.out.println(stu.getStuName());
}
session.close();
} @Override
public void testQuery3() {
SqlSession session = fac.openSession();
List<Map<String, Object>> list = session.selectList("student.query3");
for (Map<String, Object> map : list) {
System.out.println("---------------------");
System.out.println("stu_id=" + map.get("STU_ID"));
System.out.println("stu_name=" + map.get("STU_NAME"));
System.out.println("stu_birthdate=" + map.get("STU_BIRTHDATE"));
System.out.println("stu_phone=" + map.get("STU_PHONE"));
System.out.println("---------------------");
}
session.close();
}
测试
public static void main(String[] args) throws Exception {
StudentDao sdao = new StudentDaoImpl(fac);
// sdao.testGetCount();
sdao.testQuery2();
sdao.testQuery3();
}
3 MyBatis的参数类型
CRUD操作都有可能传入参数,参数类型的设置需要用到parameterType属性,属性值有以下几种情况:
- 单一类型,例如
<delete id="delete" parameterType="java.lang.Integer">
- 复合类型,例如
<update id="update" parameterType="com.icss.MyBatis.pojo.Student">
- Map集合类型,例如
<select id="query4" parameterType="java.util.HashMap" resultMap="BaseResultMap">
参数案例:
studentMapper.xml
<!-- 查询多条,传入类型为Map类型,注意左右尖括号的转义 -->
<select id="query4" parameterType="java.util.HashMap" resultMap="BaseResultMap">
<![CDATA[
select * from student
where stu_birthdate>=#{startDate} and stu_birthdate<=#{endDate}
]]>
</select>
StudentDaoImpl.java
@Override
public void testQuery4() {
SqlSession session = fac.openSession();
Map<String,Object> map = new HashMap<String, Object>();
SimpleDateFormat sdf = new SimpleDateFormat( "yyyy-MM-dd HH:mm:ss" );
try {
map.put("startDate", sdf.parse( "1990-07-10 19:20:00" ));
map.put("endDate", sdf.parse( "1992-07-10 19:20:00" ));
} catch (ParseException e) {
e.printStackTrace();
}
List<Student> list = session.selectList("student.query4",map);
for (Student stu : list) {
System.out.println(stu.getStuName());
System.out.println(stu.getStuId());
}
session.close();
}
4 #和$两种语法
- #可以进行预编译,进行类型匹配,#{变量名}会转化为jdbc的类型
- $不进行数据类型匹配,${变量名}就直接把${name}替换为name的内容
例如:
select * from tablename where id = #{id},假设id的值为12,其中如果数据库字段id为字符型,那么#{id}表示的就是'12',如果id为整型,那么#{id}就是 12 会转化为jdbc的 select * from tablename where id=?,把?参数设置为id的值。
select * from tablename where id = ${id} ,如果字段id为整型,Sql语句就不会出错,但是如果字段id为字符型,那么Sql语句应该写成 select * from table where id = '${id}' 。
- 事实上在MyBatis中使用${id}这种标识符会直接抛异常,允许直接使用的标识符只能是${value}
- 如果不需要动态指定SQL语句,应该尽量使用#而不是$,因为$语法容易被SQL注入
使用${}案例:
<!-- ${}的用法 -->
<select id="query5" resultType="java.lang.String">
select ${value} from student
</select>
@Override
public void testQuery5() {
SqlSession session = fac.openSession();
String result = (String) session.selectOne("student.query5","max(stu_id)");
System.out.println("result=" + result);
session.close();
}
仿制SQL注入:
通过输入查询条件,猜出表名。
<!-- ${}的用法 -->
<select id="query5" resultType="java.lang.String">
select stu_name from student where 1=1 and stu_id=${value}
</select>
@Override
public void testQuery5() {
SqlSession session = fac.openSession();
String result = (String) session.selectOne("student.query5","1 and (select count(*) from student)<>0");
System.out.println("result=" + result);
session.close();
}
总结:
- #将传入的数据都当成一个字符串,会对自动传入的数据加一个双引号。如:order by #user_id#,如果传入的值是111,那么解析成sql时的值为order by "111", 如果传入的值是id,则解析成的sql为order by "id".
- $将传入的数据直接显示生成在sql中。如:order by $user_id$,如果传入的值是111,那么解析成sql时的值为order by user_id, 如果传入的值是id,则解析成的sql为order by id.
- #方式能够很大程度防止sql注入。
- $方式无法防止Sql注入。
- $方式一般用于传入数据库对象,例如传入表名.
- 一般能用#的就别用$.
举个例子。写一句SQL-例如:
select * from user_role where user_code = "100";
这句话而言,需要写成 :
select * from ${tableName} where user_code = #{userCode}
$符是直接拼成sql的,#符则会以字符串的形式 与sql进行拼接。
最新文章
- Vuex2.0+Vue2.0构建备忘录应用实践
- drawing
- phpStudy
- Linux环境下配置eclipse,以及创建maven工程
- C#移动无标题栏窗体的四种代码
- 不再用.NET框架
- Python之数据序列化(json、pickle、shelve)
- Java学习笔记——序列化和反序列化
- 自学Python全栈开发第一次笔记
- BZOJ 3879: SvT [虚树 后缀树]
- [Luogu 2817]宋荣子的城堡
- 【刷题】【LeetCode】总
- 前端笔记之JavaScript(一)初识JavaScript
- Back up and restore information in Firefox profiles
- 全面超越Appium,使用Airtest超快速开发App爬虫
- U3D外包公司—北京动点(公司性质)承接U3D、Kinect、VR虚拟现实,增强现实,体感互动,大屏互动等各类外包
- python协程之动态添加任务
- ELK集群部署实例(转)
- c++实现循环队列
- JSP属性的四种保存范围(page request session application)