How does Mybatis pass in string parameters, split and traverse

This article "Mybatis how to pass string parameters, segmentation and traversal" article, the sample code introduced in the article is very detailed, has a certain reference value, interested friends must refer to, for "Mybatis how to pass string parameters, segmentation and traversal", Xiaobian organized the following knowledge points, please follow the pace of Xiaobian step by step slowly understand, then let us enter the theme bar.

How to pass string parameters, split and traverse such as foreground String str = "a,b,c,d,e,f";

This parameter is now required as a parameter of the query statement,

Select * from news where id in (${id})

Using this statement to query normally returns results, but it is bound to create sql injection vulnerabilities.

For example, amend to read:

Select * from news where id in (#{id})

Program error.

Write it correctly as follows id in#{item}Mybatis Pass in the split string as parameter

Requirement: Change a field that specifies some customers

Design: pass two parameters (one field needs to be changed, one customer id string separated by ",")

Problem: SQL statement in mybatis condition error, the reason is that #{clientIds} is passed into sql in the form of string

where id in (#{clientIds}) equals where id in ("1,2,3,4") Error

solve

Method 1: Split the customer id string into lists in the code, list traversal in mybatis

#{item}

Method 2: Split the string in mybatis

#{item}

Method 3, sql injection, changed to where id in (${clientIds})

The above is "Mybatis how to pass string parameters, split and traverse" all the content of this article, thank you for reading! I believe that everyone has a certain understanding, hope to share the content to help everyone, if you still want to learn more knowledge, welcome to pay attention to the industry information channel!