MyBatis/Ibatis中#和$的区别
1. #将传入的数据都当成一个字符串,会对自动传入的数据加一个双引号。如:order by #user_id#,如果传入的值是111,那么解析成sql时的值为order by "111", 如果传入的值是id,则解析成的sql为order by "id".
2. $将传入的数据直接显示生成在sql中。如:order by $user_id$,如果传入的值是111,那么解析成sql时的值为order by user_id, 如果传入的值是id,则解析成的sql为order by id.
3. #方式能够很大程度防止sql注入。
4.$方式无法防止Sql注入。
5.$方式一般用于传入数据库对象,例如传入表名.
6.一般能用#的就别用$.
ps:在使用mybatis中还遇到<![CDATA[]]>的用法,在该符号内的语句,将不会被当成字符串来处理,而是直接当成sql语句,比如要执行一个存储过程。
<!-- 查出所有转商户-至-转商户关系数据 -->
<select id="getTCBusinessRelationshipData" resultMap="BaseResultMap" parameterType="java.util.HashMap">
SELECT B.CUSTOMER_ID as CUSTOMER_ID
,B.RECEIVERID as RECEIVERID
,B.SHARESCALE as SHARESCALE
,NULL AS ACCEPT_TIME
,DATE('${turnoutMonth}') AS TURNOUT_TIME
,DATE('${shareStartMonth}') AS SHARE_START
,DATE('${shareStopMonth}') AS SHARE_STOP
,A.EMPLOYEE_ID AS TRANSFER_PERSON
,B.EMPLOYEE_ID AS ACCEPT_PERSON
,1 AS FLAG
,CURRENT TIMESTAMP AS CREATE_TIME
FROM
(SELECT CUSTOMER_ID,RECEIVERID,EMPLOYEE_ID ,ISSHARE,ISSELF,MONTH ,SHARESCALE
FROM TBL_CUSTOMER_RELATIONSHIP_HISTORY WHERE MONTH=#{pre_month} AND ISSELF=0) A,
(SELECT CUSTOMER_ID,RECEIVERID,EMPLOYEE_ID ,ISSHARE,ISSELF,MONTH ,SHARESCALE
FROM TBL_CUSTOMER_RELATIONSHIP WHERE MONTH=#{month} AND ISSELF=0) B
WHERE A.CUSTOMER_ID=B.CUSTOMER_ID AND A.SHARESCALE=B.SHARESCALE AND A.EMPLOYEE_ID!=B.EMPLOYEE_ID
</select>