package com.xin.mapper;
import com.xin.pojo.Users;
import java.util.List;
public interface UsersMapper {
//查询全部用户信息
List getAll();
//根据用户主键查用户
Users getById(Integer id);
//根据用户名模糊查询用户
List getByName(String name);
//用户更新
int update(Users users);
//增加用户
int insert(Users users);
//根据主键删除用户
int delete(Integer id);
}
UsersMapper.xml文件
select id,username,birthday,sex,address
from users
select id,username,birthday,sex,address
from users
where id=#{id}
update users set username=#{userName},birthday=#{birthday},sex=#{sex},address=#{address}
where id=#{id}
select id,username,birthday,sex,address
from users
where username like '%${name}%'
insert into users(username,birthday,sex,address) values(#{userName},#{birthday},#{sex},#{address})
delete from users
where id=#{id}
10)添加测试类,测试功能
package com.xin.test;
import com.xin.mapper.UsersMapper;
import com.xin.pojo.Users;
import org.apache.ibatis.io.Resources;
import org.apache.ibatis.session.SqlSession;
import org.apache.ibatis.session.SqlSessionFactory;
import org.apache.ibatis.session.SqlSessionFactoryBuilder;
import org.junit.After;
import org.junit.Before;
import org.junit.Test;
import java.io.IOException;
import java.io.InputStream;
import java.text.ParseException;
import java.text.SimpleDateFormat;
import java.util.List;
public class MyTest {
SqlSession sqlSession;
//动态代理对象
UsersMapper usersMapper;
//日期的格式化
SimpleDateFormat sf=new SimpleDateFormat("yyyy-MM-dd");
@Before
public void openSqlSession() throws IOException {
//使用文件流读取核心配置文件SqlMapConfig.xml
InputStream in= Resources.getResourceAsStream("SqlMapConfig.xml");
//创建SqlSessionFactory工厂对象
SqlSessionFactory sqlSessionFactory=new SqlSessionFactoryBuilder().build(in);
//取出SqlSession对象
sqlSession=sqlSessionFactory.openSession();
//取出动态代理对象,完成接口中方法的调用,实则是调用xml文件中相应标签的功能
usersMapper=sqlSession.getMapper(UsersMapper.class);
}
@After
public void closeSqlSession() {
sqlSession.close();
}
@Test
public void testGetAll() {
//调用接口中的方法,mybatis框架已经为我们把功能代理出来了
List list=usersMapper.getAll();
list.forEach(users-> System.out.println(users));
}
@Test
public void testById() {
Users users= usersMapper.getById(2);
System.out.println(users);
}
@Test
public void testUpdate() throws ParseException {
Users users=new Users(7,"Lihua",sf.parse("2000-01-01"),"2","北京");
int num=usersMapper.update(users);
System.out.println(num);
//切记切记切记:手工提交事务
sqlSession.commit();
}
@Test
public void testByName() {
List list=usersMapper.getByName("张");
list.forEach(users-> System.out.println(users));
}
@Test
public void testInsert() throws ParseException {
Users users=new Users("tom",sf.parse("2000-12-24"),"21","河南周口");
int num=usersMapper.insert(users);
System.out.println(num);
sqlSession.commit();
}
@Test
public void testDelete() {
int num=usersMapper.delete(29);
System.out.println(num);
sqlSession.commit();
}
}
===>入参是实体类
insert into users (username, birthday, sex, address)
values(#{userName},#{birthday},#{sex},#{address}) ==>成员变量名称
6. ${}字符串拼接或字符串替换
1)字符串拼接,一般用于模糊查询中.建议少用,因为有sql注入的风险. 也分两种情况,同样的看parameterType的类型 A. 如果parameterType的类型是简单类型,则${}里随便写,但是分版本,如果是3.5.1及以下的版本,只以写value.
===>入参是简单类型
select id,username,birthday,sex,address
from users
where username like '%${zar}%' ===>随便写
B. 如果parameterType的类型是实体类的类型,则${}里只能是类中成员变量的名称.(现在已经少用) C:模糊查询
select id,username,birthday,sex,address
from users
where username like '%${name}%'
测试:
@Test
public void testByName() {
List list=usersMapper.getByName("'or 1=1 or 1='");//sql注入
// List list=usersMapper.getByName("张");
list.forEach(users-> System.out.println(users));
}
由于输入的是" ‘or 1=1 or 1=’ ",存在SQL注入,所有的信息都被查了出来 D. 优化后的模糊查询(以后都要使用这种方式)
select id,username,birthday,sex,address
from users
where username like concat('%',#{name},'%')
测试:
@Test
public void testByNameGood() {
List list=usersMapper.getByNameGood("'or 1=1 or 1='");
// List list=usersMapper.getByName("张");
list.forEach(users -> System.out.println(users));
}
where usernamelike concat(‘%’,#{name},‘%’)使用了字符串拼接,防止了SQL注入,查不到任何信息 2)字符串替换用${} 需求:模糊地址或用户名查询 select * from users where username like ‘%小%’; select * from users where address like ‘%市%’
select id,username,birthday,sex,address
from users
where ${columnName} like concat('%',#{columnValue},'%') ==>此处使用的是@Param注解里的名称
测试;
@Test
public void testGetByNameOrAddress() {
List list=usersMapper.getByNameOrAddress("username","小");
list.forEach(users-> System.out.println(users));
}
@Test
public void testGetByNameOrAddress() {
// List list=usersMapper.getByNameOrAddress("username","小");
List list=usersMapper.getByNameOrAddress("address","市");
list.forEach(users-> System.out.println(users));
}
7.返回主键值
insert into users(username,birthday,sex,address) values(#{userName},#{birthday},#{sex},#{address})
测试:
@Test
public void testInsert() throws ParseException {
Users users=new Users("uu",sf.parse("2000-12-24"),"21","河南周口");
int num=usersMapper.insert(users);
System.out.println(num);
System.out.println(users);
sqlSession.commit();
}
可以看到,主键id=null,是因为在创建Users对象时,并没有给id传参,所以为null
在插入语句结束后, 返回自增的主键值到入参的users对象的id属性中.
select last_insert_id()
insert into users(username,birthday,sex,address) values(#{userName},#{birthday},#{sex},#{address})