MyBatis实战之动态生成SQL详解

// 传统方式需要手动拼接SQL字符串
StringBuilder sql = new StringBuilder("SELECT * FROM user WHERE 1=1");
if (user.getId() != null) {
    sql.append(" AND id = ").append(user.getId());
}
if (user.getUsername() != null) {
    sql.append(" AND username = '").append(user.getUsername()).append("'");
}
// 存在SQL注入风险！且代码冗长难维护

<select id="findUsers" parameterType="User" resultType="User">
    SELECT * FROM user
    <where>
        <if test="id != null">
            AND id = #{id}
        </if>
        <if test="username != null and username != ''">
            AND username = #{username}
        </if>
        <if test="password != null">
            AND password = #{password}
        </if>
        <if test="age != null">
            AND age = #{age}
        </if>
    </where>
</select>

<!-- 当所有if都不满足时，SQL会变成：SELECT * FROM user WHERE -->
SELECT * FROM user
WHERE
    <if test="id != null">id = #{id}</if>

SELECT * FROM user
<where>
    <if test="id != null">id = #{id}</if>
    <!-- 其他条件... -->
</where>

// 创建参数对象
User queryParams = new User();
queryParams.setId(1);
queryParams.setPassword("securePass123");

// 执行动态查询
UserRepository repo = sqlSession.getMapper(UserRepository.class);
User result = repo.get(queryParams);

SELECT * FROM user 
WHERE 
    id = ? 
    AND password = ?

<!-- 增加空字符串检查 -->
<if test="username != null and username != ''">

<if test="@org.apache.commons.lang3.StringUtils@isNotBlank(email)">
    AND email = #{email}
</if>

<select id="searchUsers">
    SELECT * FROM users
    <where>
        <choose>
            <when test="status != null">
                status = #{status}
            </when>
            <otherwise>
                status = 'ACTIVE'
            </otherwise>
        </choose>
        <if test="name != null">
            AND (first_name LIKE #{name} OR last_name LIKE #{name})
        </if>
    </where>
    ORDER BY
    <foreach item="item" collection="sortBy" separator=",">
        ${item}
    </foreach>
</select>

<!-- 使用<bind>预先处理值 -->
<bind name="pattern" value="'%' + name + '%'" />
<if test="name != null">
    AND username LIKE #{pattern}
</if>

// 输出动态SQL
configuration.setLogImpl(StdOutImpl.class);

// 监控结果
DEBUG [main] - ==>  Preparing: SELECT * FROM user WHERE id = ? 
DEBUG [main] - ==> Parameters: 1(Integer)