mybatis 动态传入排序字段 ${}防止注入

 预防传入;DELETE user,传入参数之前做判断

List<LinkedHashMap> findCertificateLevelsEntity(CertificateLevel certificateLevel);

    <!-- 查询信息返回-实体类 -->
    <select id="findCertificateLevelsEntity" parameterType="com.cn.entity.CertificateLevel" resultType="java.util.LinkedHashMap" >
        SELECT
        c.certlevelid AS "certLevelId"
        FROM
        certificatelevel c
        <where>
            1=1
            <if test='certLevelId !=null and certLevelId !=""'>
                AND c.certlevelid = #{certLevelId,jdbcType=VARCHAR}
            </if>
        </where>
        <if test='sort !=null and sort !="" and !sort.contains(";")'>
            order by c.${sort}
        </if>