Mybatis使用（2）----查询

public interface StudentMapper {
    //查询所有学生信息
    List getAll();
    //根据学生id查询
    Student getById(Integer id);
    }

	<-- 查询所有学生信息
	    没有输入参数
	    输出类型为Student
	!-->
    
        select id,name,sex,birthday,grade,tid from student
    
    <-- 根据指定id查询学生信息
	   输入参数：paramenterType 类型为Integet（int）
	   基本数据类型和String可以省略不写。
	    输出类型为 Student（在核心配置类中指定包，不需要写全限定名）
	!-->
    
        select id,name,sex,birthday,grade,tid from student where id=#{id}
    

 
3.mybatisConfig.xml 



    
    
    
    
        
    
    
    
        
    
    
    
        
            
            
                
                
                
                
                
            
        
    
    
    
        
        

    

 
4.测试 
public class test1 {
    SqlSession sqlSession;
    //动态代理对象
    StudentMapper studentMapper;
    @Before
    public void openSqlSession() throws IOException {
        //1.读取核心配置文件
        InputStream in = Resources.getResourceAsStream("myBatisConfig.xml");
        //2.创建工厂对象
        SqlSessionFactory factory = new SqlSessionFactoryBuilder().build(in);
        //3.取出sqlSession
        sqlSession = factory.openSession(true);//自动提交事务
        //4.取出动态代理的对象,完成接口中方法的调用,实则是调用xml文件中相的标签的功能
        studentMapper = sqlSession.getMapper(StudentMapper.class);
    }
    @After
    public void closeSqlSession(){
        sqlSession.close();
    }
    @Test
    public void testGetAll(){
        List list = studentMapper.getAll();
        list.forEach(student -> System.out.println(student));
    }
    @Test
    public void testGetById(){
        Student student = studentMapper.getById(3301);
        System.out.println(student);
    }
}
 
模糊查询 
1.’ ${} ’ 

 
   select id,name,sex,birthday,grade,tid from student where Name like "%${name}"
 

存在问题：sql注入

 @Test
    public void testGetByName(){
        String s=""or "1==1 ";
        List list = studentMapper.getByName(s);
        list.forEach(student -> {
            System.out.println(student);
        });
    }

sql语句直接拼接输入字段，将所有结果查询出来

==>  Preparing: select id,name,sex,birthday,grade,tid from student where Name like "%"or "1==1 "
==> Parameters: 
<==    Columns: id, name, sex, birthday, grade, tid
<==        Row: 3300, 张三, 0, 1999-01-01, 一年级, 1
<==        Row: 3301, 李四, 1, 1998-01-01, 二年级, 2
<==        Row: 3302, 王五, 1, 1997-01-01, 三年级, 1
<==        Row: 3303, 赵六, 0, 1998-08-01, 二年级, 2
<==        Row: 3304, 钱七, 1, 1996-01-01, 四年级, 3
<==        Row: 3305, 周八, 0, 1995-01-01, 五年级, 1
<==      Total: 6
Student{id=3300, name='张三', sex=0, birthday=Fri Jan 01 00:00:00 GMT+08:00 1999, grade='一年级', tid=1}
Student{id=3301, name='李四', sex=1, birthday=Thu Jan 01 00:00:00 GMT+08:00 1998, grade='二年级', tid=2}
Student{id=3302, name='王五', sex=1, birthday=Wed Jan 01 00:00:00 GMT+08:00 1997, grade='三年级', tid=1}
Student{id=3303, name='赵六', sex=0, birthday=Sat Aug 01 00:00:00 GMT+08:00 1998, grade='二年级', tid=2}
Student{id=3304, name='钱七', sex=1, birthday=Mon Jan 01 00:00:00 GMT+08:00 1996, grade='四年级', tid=3}
Student{id=3305, name='周八', sex=0, birthday=Sun Jan 01 00:00:00 GMT+08:00 1995, grade='五年级', tid=1}

    
        select 
        from student
        where name like concat("%",#{name},"%")
    

@Test
    public void testGetByNameGood(){
        String s=""or "1==1 ";
        String ss="%五";
        List list = studentMapper.getByNameGood(s);
        List list1 = studentMapper.getByNameGood(ss);
        list.forEach(student -> {
            System.out.println(student);
        });
        list1.forEach(student -> {
            System.out.println(student);
        });
    }

==>  Preparing: select id,name,sex,birthday,grade,tid from student where name like concat("%",?,"%")
==> Parameters: "or "1==1 (String)
<==      Total: 0
==>  Preparing: select id,name,sex,birthday,grade,tid from student where name like concat("%",?,"%")
==> Parameters: %五(String)
<==    Columns: id, name, sex, birthday, grade, tid
<==        Row: 3302, 王五, 1, 1997-01-01, 三年级, 1
<==      Total: 1