模糊查询like语句该怎么写?

第1种：在Java代码中添加sql通配符。

string wildcardname = “%smi%”;
list names = mapper.selectlike(wildcardname);


select * from foo where bar like #{value}

 
第2种：在sql语句中拼接通配符，会引起sql注入
 
string wildcardname = “smi”;
list names = mapper.selectlike(wildcardname);


    select * from foo where bar like "%"#{value}"%"