MyBatis中#{}和${}的区别,什么是sql注入？如何防止？

首先咱们先看#{}收参的代码及执行结果：

 <select id="selectUserByName" resultType="com.zf.entity.User">
        select * from t_users where name=#{name}
 </select>

 @Test
    public void selectUserByName() throws IOException {
        UserDao userDao = MybatisUtils.getMapper(UserDao.class);
        User user = userDao.selectUserByName("zeor");
        System.out.println(user);
    }

logback [main] DEBUG com.zf.dao.UserDao.selectUserByName - ==>  Preparing: select * from  t_users where name=? 
logback [main] DEBUG com.zf.dao.UserDao.selectUserByName - ==> Parameters: zeor(String)
logback [main] DEBUG com.zf.dao.UserDao.selectUserByName - <==      Total: 1

完整SQL语名：select * from  t_users where name="zeor"

 然后咱们再看${}的收参方式执行的代码和执行结果