1、select * from table where name = #{aaa};
2、select * from table where name in (${bbb});
当为#时候,如果aaa为字符串,值为小三,sql中实际上是等价于 select * from table where name = '小三';
当为$时候,实际上是等价于select * from table where name in (小三);
而sql1中相当于变量替换,相当于sql预编译
而sql2中相当于字符串拼接,相当于sql注入
当sql中查询条件是变量时候最好使用#
当sql中表名是变量的时候使用$
$ 的作用实际上是字符串拼接,
select * from $tableName$
等效于
StringBuffer sb = new StringBuffer();
sb.append("select * from ").append(tableName);
sb.toString();
#用于变量替换
select * from table where id = #id#
等效于
prepareStement = stmt.createPrepareStement("select * from table where id = ?")
prepareStement.setString(1,'abc');