MyBatis防止SQL注入攻击的有效方法

// MyBatis生成的SQL
String sql = "SELECT * FROM users WHERE id = ?";

// JDBC预编译处理
PreparedStatement pstmt = connection.prepareStatement(sql);
pstmt.setInt(1, userId);

<select id="getUser" resultType="User">
    SELECT * FROM users WHERE username = #{username}
</select>

<!-- 危险示例：存在SQL注入风险 -->
<select id="getUser" resultType="User">
    SELECT * FROM users ORDER BY ${columnName}
</select>

<select id="findUsers" resultType="User">
    SELECT * FROM users
    <where>
        <if test="username != null">
            AND username = #{username}
        </if>
        <if test="email != null">
            AND email = #{email}
        </if>
    </where>
</select>

// 安全
@Select("SELECT * FROM users WHERE username = #{username}")
User findByUsername(@Param("username") String username);

// 危险！存在注入风险
@Select("SELECT * FROM users WHERE username = '${username}'")
User findByUsernameInsecure(@Param("username") String username);

<select id="queryByField" resultType="map">
    SELECT * FROM ${tableName}
    ORDER BY 
    <choose>
        <when test="orderBy == 'name'">name</when>
        <when test="orderBy == 'createTime'">create_time</when>
        <otherwise>id</otherwise>
    </choose>
</select>

public String safeColumnName(String input) {
    // 只允许字母、数字和下划线
    if (!input.matches("^[a-zA-Z0-9_]+$")) {
        throw new IllegalArgumentException("Invalid column name");
    }
    return input;
}

<select id="findUsersByIds" resultType="User">
    SELECT * FROM users
    WHERE id IN
    <foreach collection="ids" item="id" open="(" separator="," close=")">
        #{id}
    </foreach>
</select>

<!-- 安全写法 -->
<select id="searchUsers" resultType="User">
    SELECT * FROM users
    WHERE username LIKE CONCAT('%', #{keyword}, '%')
</select>

<!-- 或者 -->
<select id="searchUsers" resultType="User">
    SELECT * FROM users
    WHERE username LIKE #{pattern}
</select>

@Intercepts({
    @Signature(type= StatementHandler.class, 
              method="parameterize", 
              args=Statement.class)
})
public class SqlInjectionInterceptor implements Interceptor {
    @Override
    public Object intercept(Invocation invocation) throws Throwable {
        // 检查参数中的可疑内容
        // ...
        return invocation.proceed();
    }
}

// 危险！
@Select("SELECT * FROM ${tableName} WHERE id = #{id}")
User findById(@Param("tableName") String tableName, @Param("id") Long id);