实例讲解MyBatis如何防止SQL注入

table user(
id	 varchar(20)	PRIMARY KEY ,		
name     varchar(20)	  	    ,
age	 varchar(20)	  	   );

private String getNameByUserId(String userId) {
    Connection conn = getConn();//获得连接
    String sql = "select name from user where id=" + userId;
    PreparedStatement pstmt =  conn.prepareStatement(sql);
    ResultSet rs=pstmt.executeUpdate();
    ......
}

select name from user where id=3; drop table user;

               Connection conn = getConn();//获得连接
    	       String sql = "select name from user where id= ?";
    	       PreparedStatement pstmt = conn.prepareStatement(sql);
    	       pstmt.setString(1, userId);
    	       ResultSet rs=pstmt.executeUpdate();
    	       ......

               Connection conn = getConn();
    	       stmt = conn.prepareCall("{call name_from_user(?,?)}");  
    	       stmt.setInt(1,2);  
    	       stmt.registerOutParameter(2, Types.VARCHAR);  
    	       stmt.execute();  
    	       String name= stmt.getString(2); 

use user;
delimiter //
create  procedure name_from_user(in user_id int,out user_name varchar(20))
begin
	select name into user_name from user where id=user_id;
end
//
delimiter ;

<select id="getNameByUserId" resultType="String">
		SELECT name FROM user where id = #{userId}
</select>

public interface UserMapper{
	String getNameByUserId(@Param("userId") String userId);
}

select name from user where id = ?

<select id="getNameByUserId" resultType="String">
		SELECT name FROM user where id = ${userId}
</select>

select name from user where id = 34;drop table user;