MyBatis实现模糊查询的几种方式

在学习MyBatis过程中想实现模糊查询，可惜失败了。后来上百度上查了一下，算是解决了。记录一下MyBatis实现模糊查询的几种方式。 
　　数据库表名为test_student,初始化了几条记录，如图： 
　　 
　　 
　　起初我在MyBatis的mapper文件中是这样写的：

    <select id="searchStudents" resultType="com.example.entity.StudentEntity"
        parameterType="com.example.entity.StudentEntity">
        SELECT * FROM test_student
        <where>
            <if test="age != null and age != '' and compare != null and compare != ''">
                age
                ${compare}
                #{age}
            </if>
            <if test="name != null and name != ''">
                AND name LIKE '%#{name}%'
            </if>
            <if test="address != null and address != ''">
                AND address LIKE '%#{address}%'
            </if>
        </where>
        ORDER BY id
    </select>

写完后自我感觉良好，很开心的就去跑程序了，结果当然是报错了： 

　　经百度得知，这么写经MyBatis转换后(‘%#{name}%’)会变为(‘%?%’),而(‘%?%’)会被看作是一个字符串，所以Java代码在执行找不到用于匹配参数的 ‘?’ ,然后就报错了。

解决方法

1.用${…}代替#{…}

   <select id="searchStudents" resultType="com.example.entity.StudentEntity"
        parameterType="com.example.entity.StudentEntity">
        SELECT * FROM test_student
        <where>
            <if test="age != null and age != '' and compare != null and compare != ''">
                age
                ${compare}
                #{age}
            </if>
            <if test="name != null and name != ''">
                AND name LIKE '%${name}%'
            </if>
            <if test="address != null and address != ''">
                AND address LIKE '%${address}%'
            </if>
        </where>
        ORDER BY id
    </select>

查询结果如下图： 

　　注：使用${…}不能有效防止SQL注入，所以这种方式虽然简单但是不推荐使用！！！

 

2.把’%#{name}%’改为”%”#{name}”%”

   <select id="searchStudents" resultType="com.example.entity.StudentEntity"
        parameterType="com.example.entity.StudentEntity">
        SELECT * FROM test_student
        <where>
            <if test="age != null and age != '' and compare != null and compare != ''">
                age
                ${compare}
                #{age}
            </if>
            <if test="name != null and name != ''">
                AND name LIKE "%"#{name}"%"
            </if>
            <if test="address != null and address != ''">
                AND address LIKE "%"#{address}"%"
            </if>
        </where>
        ORDER BY id
    </select>

 

查询结果： 

3.使用sql中的字符串拼接函数

gaoshan12345678910备注：这里的CONCAT函数可能有些问题，如果要使用此种方法，请先查询一下CONCAT函数。不同数据库类型，例如ORACLE和MYSQL，字符串连接函数也有差异，所以这种方式无法跨数据库。

   <select id="searchStudents" resultType="com.example.entity.StudentEntity"
        parameterType="com.example.entity.StudentEntity">
        SELECT * FROM test_student
        <where>
            <if test="age != null and age != '' and compare != null and compare != ''">
                age
                ${compare}
                #{age}
            </if>
            <if test="name != null and name != ''">
                AND name LIKE CONCAT(CONCAT('%',#{name},'%'))
            </if>
            <if test="address != null and address != ''">
                AND address LIKE CONCAT(CONCAT('%',#{address},'%'))
            </if>
        </where>
        ORDER BY id
    </select>

查询结果： 

 

4.使用标签，可以跨数据库，可以防sql注入

   <select id="searchStudents" resultType="com.example.entity.StudentEntity"
        parameterType="com.example.entity.StudentEntity">
        <bind name="pattern1" value="'%' + _parameter.name + '%'" />
        <bind name="pattern2" value="'%' + _parameter.address + '%'" />
        SELECT * FROM test_student
        <where>
            <if test="age != null and age != '' and compare != null and compare != ''">
                age
                ${compare}
                #{age}
            </if>
            <if test="name != null and name != ''">
                AND name LIKE #{pattern1}
            </if>
            <if test="address != null and address != ''">
                AND address LIKE #{pattern2}
            </if>
        </where>
        ORDER BY id
    </select>

查询结果： 

5.在Java代码中拼接字符串 

param.setUsername("%CD%");
param.setPassword("%11%");

	<select  id="selectPersons" resultType="person" parameterType="person">
		select id,sex,age,username,password from person where true 
			<if test="username!=null"> AND username LIKE #{username}</if>
			<if test="password!=null">AND password LIKE #{password}</if>
	
	</select>