mybatis写sql注入参数的两种方式

mybatis写sql注入参数的两种方式

//mapper接口中当用到@注解时这样写
List<TopicInfo> selectUserTopics
(@Param("userId")int userId, @Param("keyword")String keyword);

mapper.xml中则这样写
<select id="selectUserTopics" resultMap="BaseResultMap">
 select t1.*
    from tms_topic_info t1,
    tms_topic_sysusers t2
    where t2.is_deleted = 0 and t1.id = t2.topic_id and t2.user_id =#{userId,jdbcType=INTEGER}
    <if test="keyword != null">
      and t1.topic_name like #{keyword,jdbcType=VARCHAR}
    </if>
    order by created_time desc
</select>

 //mypper接口中不使用@注解时
 //根据分类查询文章 文章id
 List<Map<String, Object>> selectArticleByCategory(Integer id);

<select id="selectArticleByCategory" parameterType="java.lang.Integer" resultType="java.util.Map">
   SELECT    t1.id as categoryId,
             t1.topic_id as topicId,
             t1.category_name as categoryName,
             t1.category_type as categoryType,
             t1.type as type,
             t2.id as categoryContentId,
             t3.id as contentId,
             t3.article_name as title,
             t3.introduce as introduce,
             t3.article_url as contentUrl,
             DATE_FORMAT(t2.created_time,'%y-%m-%d') as createdTime

     from    tms_category t1,
             tms_category_content t2,
             tms_article_info t3

     where
                t2.is_deleted = 0
            and t1.id = t2.category_id
            and t2.content_id = t3.id
            and t1.ct_parent = #{id}
     order by    t3.is_top desc, t3.created_time desc

 </select>