mybatis的#与$的区别

#{} 底层使用PreparedStatement来执行SQL语句
${} 底层使用Statement来执行SQL语句

1、会预编译，防止sql注入

select * from user where id =#{id}

会变编译为

select * from user where id = '1'

2、一般能用#的就别用$

1、传入什么就是什么，不会对字符串进行处理

select * from user where id =#{id}

会变编译为

select * from user where id = 1

2、不能防止sql注入问题
3、一般传入的是表名，注意的是order by 后面的是传入${}

    
        
            org.springframework.boot
            spring-boot-starter-web
        
        
            com.baomidou
            mybatis-plus-boot-starter
            3.4.2
        

        
            mysql
            mysql-connector-java
            runtime
        
        
            org.projectlombok
            lombok
            true
        
        
            org.springframework.boot
            spring-boot-starter-test
            test
            
                
                    org.junit.vintage
                    junit-vintage-engine
                
            
        
    

package com.ycz.mybatis.entity;

import com.baomidou.mybatisplus.annotation.IdType;
import com.baomidou.mybatisplus.annotation.TableId;
import lombok.Data;


@Data
public class User {
    @TableId(type = IdType.AUTO)
    private Integer id;

    private String name;

    private String pwd;

    private String gender;

    private String qq;

    private Integer age;

    private String address;

    private String email;

    private Integer deleted;
}

spring.datasource.driver-class-name=com.mysql.cj.jdbc.Driver
# 数据源名称
spring.datasource.name=defaultDataSource
# 数据库连接地址
spring.datasource.url=jdbc:mysql://localhost:3306/temp?serverTimezone=UTC
# 数据库用户名&密码：
spring.datasource.username=root
spring.datasource.password=123456

mybatis-plus.configuration.log-impl=org.apache.ibatis.logging.stdout.StdOutImpl
mybatis-plus.mapper-locations=classpath*:com/ycz**/xml
@Mapper
public interface UserMapper extends BaseMapper {

   void insert2(@Param("tableName")String tableName , @Param("user") User user);

   List selectUser(@Param("tableName")String tableName , @Param("orderByTemp")String orderByTemp);

}

    
        insert into ${tableName} (`name` , pwd,gender,qq,age,address,email,deleted)
        values(#{user.name},#{user.pwd} , #{user.gender} ,
               #{user.qq} ,#{user.age} , #{user.address} , #{user.email} , #{user.deleted} )
    

    
        select * from  ${tableName} order by ${orderByTemp}
    

测试：

  @Test
    void insert2(){
        User user = new User();
        user.setAddress("sz");
        user.setAge(18);
        user.setName("asdasd");
        user.setGender("男");
        user.setEmail("51561651@qq。com");
        user.setQq("asdasd");
        user.setDeleted(0);
        userMapper.insert2("user" , user);
    }

结果:

成功

   @Test
    void select(){
        List users = userMapper.selectUser("user", "age");
        users.forEach(System.out::println);
    }

结果：

成功