MyBatis提升数据库安全与性能的4大实战技巧(防注入/动态SQL/模糊优化/连接池)

<!-- Mapper XML -->
<select id="findUserByNameUnsafe" resultType="User">
  SELECT * FROM user WHERE name = '${name}'
</select>

// Java 调用
String maliciousInput = "' OR '1'='1";
List<User> users = userMapper.findUserByNameUnsafe(maliciousInput);

SELECT * FROM user WHERE name = '' OR '1'='1'

<!-- Mapper XML -->
<select id="findUserByNameSafe" resultType="User">
  SELECT * FROM user WHERE name = #{name}
</select>

// Java 调用
String maliciousInput = "' OR '1'='1";
List<User> users = userMapper.findUserByNameSafe(maliciousInput);

SELECT * FROM user WHERE name = ?

SELECT * FROM user WHERE name = ?

SELECT * FROM user WHERE name = '' OR '1'='1'

<select id="findUsersOrdered" resultType="User">
  SELECT * FROM user
  ORDER BY ${sortField} ${sortOrder}
</select>

// Service 层校验排序字段
public List<User> getUsersOrdered(String sortField, String sortOrder) {
    // 定义允许的字段 (白名单)
    Set<String> validFields = Set.of("id", "name", "create_time");
    Set<String> validOrders = Set.of("ASC", "DESC");
    if (!validFields.contains(sortField)) {
        sortField = "id"; // 默认字段
    }
    if (!validOrders.contains(sortOrder)) {
        sortOrder = "ASC"; // 默认排序
    }
    return userMapper.findUsersOrdered(sortField, sortOrder);
}

// 正常调用
getUsersOrdered("name", "DESC"); 
// SQL: SELECT * FROM user ORDER BY name DESC
// 攻击尝试
getUsersOrdered("(SELECT 1 FROM DUAL); DROP TABLE user; --", "DESC");
// 白名单过滤 → SQL: SELECT * FROM user ORDER BY id ASC ✅

<select id="findUsers" resultType="User">
  SELECT * FROM user
  WHERE 1=1
  <if test="name != null">
    AND name = #{name}
  </if>
  <if test="email != null">
    AND email = #{email}
  </if>
</select>

// 只传 name
mapper.findUsers("Alice", null);
// SQL: SELECT * FROM user WHERE 1=1 AND name = 'Alice'
// 传 name 和 email
mapper.findUsers("Bob", "bob@example.com");
// SQL: SELECT * FROM user WHERE 1=1 AND name = 'Bob' AND email = 'bob@example.com'

<select id="searchUsers" resultType="User">
  SELECT * FROM user
  WHERE
  <choose>
    <when test="id != null">
      id = #{id}
    </when>
    <when test="name != null">
      name LIKE CONCAT('%', #{name}, '%')
    </when>
    <otherwise>
      status = 'ACTIVE'
    </otherwise>
  </choose>
</select>

// 传 id
mapper.searchUsers(1001, null, null);
// SQL: SELECT * FROM user WHERE id = 1001
// 传 name
mapper.searchUsers(null, "John", null);
// SQL: SELECT * FROM user WHERE name LIKE '%John%'
// 不传参数
mapper.searchUsers(null, null, null);
// SQL: SELECT * FROM user WHERE status = 'ACTIVE'

<select id="findActiveUsers" resultType="User">
  SELECT * FROM user
  <where>
    <if test="name != null">
      name = #{name}
    </if>
    <if test="role != null">
      AND role = #{role}
    </if>
  </where>
</select>

<update id="updateUser">
  UPDATE user
  <set>
    <if test="name != null">name=#{name},</if>
    <if test="email != null">email=#{email},</if>
    <if test="role != null">role=#{role}</if>
  </set>
  WHERE id=#{id}
</update>

// 只更新 email
User user = new User();
user.setId(1001);
user.setEmail("new@example.com");
mapper.updateUser(user);
// SQL: UPDATE user SET email='new@example.com' WHERE id=1001

<select id="findUsersByIds" resultType="User">
  SELECT * FROM user
  WHERE id IN
  <foreach item="id" collection="ids" 
           open="(" separator="," close=")">
    #{id}
  </foreach>
</select>

List<Integer> ids = Arrays.asList(101, 102, 103);
mapper.findUsersByIds(ids);
// SQL: SELECT * FROM user WHERE id IN (101,102,103)

<insert id="batchInsert">
  INSERT INTO user (name, email) VALUES
  <foreach item="user" collection="users" separator=",">
    (#{user.name}, #{user.email})
  </foreach>
</insert>

INSERT INTO user (name, email) VALUES
('Alice','alice@test.com'),
('Bob','bob@test.com'),
('Charlie','charlie@test.com')

<select id="dynamicSearch" resultType="User">
  SELECT * FROM user
  <trim prefix="WHERE" prefixOverrides="AND |OR ">
    <if test="name != null">
      AND name = #{name}
    </if>
    <if test="role != null">
      OR role = #{role}
    </if>
  </trim>
</select>

// Service层处理
public List<User> searchUsers(String keyword) {
    String searchTerm = "%" + keyword + "%";  // 添加通配符
    return userMapper.findByNameLike(searchTerm);
}

<!-- Mapper XML -->
<select id="findByNameLike" resultType="User">
  SELECT * FROM user 
  WHERE name LIKE #{pattern}
</select>

searchUsers("john");
// SQL：SELECT * FROM user WHERE name LIKE '%john%'
// 返回：所有包含"john"的用户（如"john123", "xxx_john"）

<!-- MySQL示例 -->
<select id="findByNameLike" resultType="User">
  SELECT * FROM user 
  WHERE name LIKE CONCAT('%', #{keyword}, '%')
</select>
<!-- Oracle示例 -->
<select id="findByNameLike" resultType="User">
  SELECT * FROM user 
  WHERE name LIKE '%' || #{keyword} || '%'
</select>

<select id="findByNameLike" resultType="User">
  <bind name="pattern" value="'%' + keyword + '%'" />
  SELECT * FROM user 
  WHERE name LIKE #{pattern}
</select>

spring:
  datasource:
    url: jdbc:mysql://localhost:3306/mydb
    username: root
    password: 123456
    driver-class-name: com.mysql.cj.jdbc.Driver
    hikari:
      pool-name: MyHikariPool
      maximum-pool-size: 20          # 关键配置！
      minimum-idle: 5                # 推荐等于maximum-pool-size
      connection-timeout: 30000      # 30秒
      idle-timeout: 600000           # 10分钟
      max-lifetime: 1800000          # 30分钟
      connection-test-query: SELECT 1
      leak-detection-threshold: 5000 # 连接泄露检测(ms)

spring:
  datasource:
    url: jdbc:mysql://localhost:3306/mydb
    username: root
    password: 123456
    driver-class-name: com.mysql.cj.jdbc.Driver
    type: com.alibaba.druid.pool.DruidDataSource # 指定类型
    druid:
      initial-size: 5
      min-idle: 5
      max-active: 20                 # 相当于Hikari的maximum-pool-size
      max-wait: 60000                # 获取连接超时时间
      filters: stat,wall,slf4j        # 开启监控
      # 监控配置
      stat-view-servlet:
        enabled: true
        url-pattern: /druid/*
        login-username: admin
        login-password: admin
      web-stat-filter:
        enabled: true
        url-pattern: /*
      filter:
        stat:
          log-slow-sql: true         # 记录慢SQL
          slow-sql-millis: 1000      # 慢SQL阈值(ms)