关于mysql.xml文件中 #{_parameter}的说明

关注

原创最新推荐文章于 2026-07-02 10:52:09 发布 3k 阅读 AI 写同款· GEO 优化 ›

MyBatis #{}} 与 ${} 的本质区别：从SQL解析链路看注入防御机制 SQL注入防御的核心在于区分‘数据’与‘结构’——预编译（PreparedStatement）仅对值参数生效，而表名、列名、排序字段等SQL结构参数必须通过白名单校验+安全拼接实现防护。MyBatis中#{}触发DynamicSqlSource与参数绑定流程，${}则生成RawSqlSource并绕过JDBC预编译，导致数据库直接解析恶意字符串。理解SqlSource构建、BoundSql生成及Executor执行三层机制，才能在动态ORDER BY、分表路由、IN条件等高频场景中精准设防。本文深入MyBa 阅读详情

dao: */
public List<UserGdataStatisticsTotalCount> getUserTotalCountBarData(Integer orgId){
List<UserGdataStatisticsTotalCount> countList=null;
try {
countList=this.getSqlSession().selectList(getMethodPath("getUserTotalCountBarData"), orgId);
} catch (Exception e) {
e.printStackTrace();
}
return countList;

}

xml:<select id="getUserTotalCountBarData" resultMap="UserGdataStatisticsTotalCountMap" parameterType="Map">
SELECT
o.`organizationId`,o.`organizationName`,
(SELECT SUM(quantity) FROM `t_user_gdata_statistics_total_count` WHERE LOCATE(o.`organizationPath`,organizationPath)=1) quantity
FROM
`t_user_organization` o
WHERE (
o.`organizationId` = #{_parameter}
OR o.`parentOrganizationId` = #{_parameter}
)
</select>

执行:

Preparing: SELECT o.`organizationId`,o.`organizationName`, (SELECT SUM(quantity) FROM `t_user_gdata_statistics_total_count` WHERE LOCATE(o.`organizationPath`,organizationPath)=1) quantity FROM `t_user_organization` o WHERE ( o.`organizationId` = ? OR o.`parentOrganizationId` = ? )
Parameters: 1(Integer), 1(Integer)
Total: 34

#{_parameter}这个在里面是我理解成通用变量.

收录于