MyBatis中#{}和${}的区别及底层原理、适用场景和安全风险

@Select("select * from user_info where username = #{name}")
UserInfo queryByName(String name);

@Select("select * from user_info where username = ${name}")
UserInfo queryByName(String name);

SELECT * FROM user WHERE username = '${name}' AND pwd = '${pwd}'

SELECT * FROM user WHERE username = 'admin' -- ' AND pwd = 'xxx'

import com.example.demo.model.UserInfo;
import com.example.demo.service.UserService;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.web.bind.annotation.RequestMapping;
import org.springframework.web.bind.annotation.RestController;
@RestController
public class UserTestController {
    @Autowired
    private UserTestService userService;
    @RequestMapping("/login")
    public boolean login(String name, String password) {
        UserInfo userInfo = userService.queryUserByPassword(name, password);
        if (userInfo != null) {
            return true;
        }
        return false;
    }
}

import com.example.demo.mapper.UserInfoMapper;
import com.example.demo.model.UserInfo;
import org.springframework.beans.factory.annotation.Autowired;
import org.springframework.stereotype.Service;
@Service
public class UserTestService {
    @Autowired
    private UserInfoTestMapper userInfoMapper;
    public UserInfo queryUserByPassword(String name, String password) {
        List<UserInfo> userInfos = userInfoMapper.queryUserByPassword(name, password);
        if (userInfos != null && userInfos.size() > 0) {
            return userInfos.get(0);
        }
        return null;
    }
}

import com.example.demo.model.UserInfo;
import org.apache.ibatis.annotations.*;
import java.util.List;
@Mapper
public interface UserInfoTestMapper {
    @Select("select username, `password`, age, gender, phone from user_info where username= '${name}' and password='${password}' ")
        List<UserInfo> queryUserByPassword(String name, String password);
}