五、MySql+Mybatis+Druid：报sql injection violation, comment not allow异常

  报错的sql语句：

<update id="synchronizedStar" parameterType="Date">
        <if test="lastUpdateTime == null">
            update business b,(
            #建立商户与星级的对应关系表
            select o.business_id,sum(a.star) totalStar,count(*) totalComment from orders o,
            #订单编号与star的对应关系表
            (select order_id,star from `comment` where createTime&lt;=#{currentTime})a
            where o.id=a.order_id group by o.business_id
            )temp
            set b.star=b.star + temp.totalStar,b.commentNum=b.commentNum+temp.totalComment where b.id=temp.business_id
        </if>
        <if test="lastUpdateTime != null">
            update business b,(
            select o.business_id,sum(a.star) totalStar,count(*) totalComment from orders o,
            (select order_id,star from `comment` where createTime&gt;#{lastUpdateTime} AND createTime&lt;=#{currentTime})a
            where o.id=a.order_id group by o.business_id
            )temp
            set b.star=b.star + temp.totalStar,b.commentNum=b.commentNum+temp.totalComment where b.id=temp.business_id
        </if>
    </update>

  经查源码发现，在Mybatis的配置文件中，不能出现“#建立商户与星级的对应关系表”注解，删除掉即可！