|
|
<!doctypehtml><html lang=zh-CN><meta charset=UTF-8><meta content=width=device-width name=viewport><meta media="(prefers-color-scheme: light)" content=#222 name=theme-color><meta media="(prefers-color-scheme: dark)" content=#222 name=theme-color><meta content="Hexo 7.3.0" name=generator><link href=https://cdnjs.cloudflare.com rel=preconnect><link href=/images/apple-touch-icon-next.png rel=apple-touch-icon sizes=180x180><link href=/images/favicon-32x32-next.png rel=icon sizes=32x32 type=image/png><link href=/images/favicon-16x16-next.png rel=icon sizes=16x16 type=image/png><link color=#222 href=/images/logo.svg rel=mask-icon><meta content=2X6S9P7CAjXjVvw8YyQR8pCu-B0oEu7O9quLgxXuWyA name=google-site-verification><meta content=dV8JGNzi0c name=baidu-site-verification><script>!function(){var t=!1;function e(){var e;t||(t=!0,(e=document.createElement("script")).setAttribute("data-ad-client","ca-pub-7480618470784058"),e.async=!0,e.src="https://pagead2.googlesyndication.com/pagead/js/adsbygoogle.js",document.head.appendChild(e))}function a(){"requestIdleCallback"in window?window.requestIdleCallback(e,{timeout:5e3}):window.setTimeout(e,5e3)}"complete"===document.readyState?a():window.addEventListener("load",a,{once:!0})}()</script><link href=/css/main.css rel=stylesheet><link crossorigin=anonymous href=https://cdnjs.cloudflare.com/ajax/libs/font-awesome/7.0.0/css/all.min.css integrity=sha256-VHqXKFhhMxcpubYf9xiWdCiojEbY9NexQ4jh8AxbvcM= rel=stylesheet><link crossorigin=anonymous href=https://cdnjs.cloudflare.com/ajax/libs/fancyapps-ui/6.1.14/fancybox/fancybox.css integrity=sha256-mdaMxrItEW6hMIVJJNPKuX0B7KCSJQVEv3mVY4N2we4= rel=stylesheet><script class=next-config data-name=main type=application/json>{"hostname":"nicksxs.me","root":"/","images":"/images","scheme":"Pisces","darkmode":true,"version":"8.29.0","exturl":false,"sidebar":{"position":"left","width_expanded":320,"width_dual_column":240,"display":"post","padding":18,"offset":12},"hljswrap":true,"codeblock":{"theme":{"light":"default","dark":"stackoverflow-dark"},"prism":{"light":"prism","dark":"prism-dark"},"copy_button":{"enable":true,"style":"default"},"fold":{"enable":false,"height":500},"language":false},"bookmark":{"enable":false,"color":"#222","save":"auto"},"mediumzoom":false,"pangu":false,"comments":{"style":"tabs","active":null,"storage":true,"lazyload":true,"nav":null},"stickytabs":false,"motion":{"enable":false,"async":false,"duration":200,"transition":{"menu_item":"fadeInDown","post_block":"fadeIn","post_header":"fadeInDown","post_body":"fadeInDown","coll_header":"fadeInLeft","sidebar":"fadeInUp"}},"prism":false,"i18n":{"placeholder":"搜索...","empty":"没有找到任何搜索结果:${query}","hits_time":"找到 ${hits} 个搜索结果(用时 ${time} 毫秒)","hits":"找到 ${hits} 个搜索结果"},"algolia":{"appID":"663Q99OQQD","apiKey":"e461a1371d12cec1491c1153b288a9ed","indexName":"nicksxs","hits":{"per_page":10}}}</script><script defer src=/js/config.js></script><meta content="本文从 MyBatis 源码和 SQL 解析过程说明 #{} 与 ${} 的区别,分析预编译参数、字符串替换、动态 SQL、适用场景以及 SQL 注入风险。" name=description><meta content=article property=og:type><meta content="mybatis 的 $ 和 # 是有啥区别" property=og:title><meta content=https://nicksxs.me/2020/09/06/mybatis-%E7%9A%84-%E5%92%8C-%E6%98%AF%E6%9C%89%E5%95%A5%E5%8C%BA%E5%88%AB/index.html property=og:url><meta content="Nicksxs's Blog" property=og:site_name><meta content="本文从 MyBatis 源码和 SQL 解析过程说明 #{} 与 ${} 的区别,分析预编译参数、字符串替换、动态 SQL、适用场景以及 SQL 注入风险。" property=og:description><meta content=zh_CN property=og:locale><meta content=https://img.nicksxs.me/uPic/c84r0g.png property=og:image><meta content=https://img.nicksxs.me/uPic/E0ODcp.png property=og:image><meta content=https://img.nicksxs.me/uPic/dnZWP7.png property=og:image><meta content=https://img.nicksxs.me/uPic/YGVD0P.png property=og:image><meta content=https://img.nicksxs.me/uPic/BWHuUO.png property=og:image><meta content=https://img.nicksxs.me/uPic/eTiQm6.png property=og:image><meta content=https://img.nicksxs.me/uPic/Cc4JPw.png property=og:image><meta content=https://img.nicksxs.me/uPic/fRHpNO.png property=og:image><meta content=https://img.nicksxs.me/uPic/4tNU7f.png property=og:image><meta content=2020-09-06T15:14:50.000Z property=article:published_time><meta content=2020-09-06T15:14:50.000Z property=article:modified_time><meta content=Nicksxs property=article:author><meta content=Java property=article:tag><meta content=Mysql property=article:tag><meta content=Mybatis property=article:tag><meta content=Sql注入 property=article:tag><meta content=summary name=twitter:card><meta content=https://img.nicksxs.me/uPic/c84r0g.png name=twitter:image><link href=https://nicksxs.me/2020/09/06/mybatis-%E7%9A%84-%E5%92%8C-%E6%98%AF%E6%9C%89%E5%95%A5%E5%8C%BA%E5%88%AB/ rel=canonical><script class=next-config data-name=page type=application/json>{"sidebar":"","isHome":false,"isPost":true,"lang":"zh-CN","comments":true,"permalink":"https://nicksxs.me/2020/09/06/mybatis-%E7%9A%84-%E5%92%8C-%E6%98%AF%E6%9C%89%E5%95%A5%E5%8C%BA%E5%88%AB/","path":"2020/09/06/mybatis-的-和-是有啥区别/","title":"mybatis 的 $ 和 # 是有啥区别"}</script><script class=next-config data-name=calendar type=application/json>""</script><title>mybatis 的 $ 和 # 是有啥区别 | Nicksxs's Blog</title><script async src=https://www.googletagmanager.com/gtag/js?id=UA-61358619-1></script><script class=next-config data-name=google_analytics type=application/json>{"tracking_id":"UA-61358619-1","only_pageview":false,"measure_protocol_api_secret":null}</script><script defer src=/js/third-party/analytics/google-analytics.js></script><script defer src=/js/third-party/analytics/baidu-analytics.js></script><script async src=https://hm.baidu.com/hm.js?20f33b3c0c0eff9b1522999c0015646d></script><script crossorigin=anonymous defer integrity=sha256-QnJV4HT5r8i89ovZGRD86iynZqHerEbT2xt69vDM36I= src=https://cdnjs.cloudflare.com/ajax/libs/fancyapps-ui/6.1.14/fancybox/fancybox.umd.js></script><script defer src=/js/utils.js></script><script defer src=/js/sidebar.js></script><script defer src=/js/next-boot.js></script><script data-algolia-integrity=sha256-o49zoHLDPBm9WLg6AiliAVi3axCRTqe3ltTxLvhzAVg= data-algolia-src=https://cdnjs.cloudflare.com/ajax/libs/algoliasearch/5.36.0/lite/builds/browser.umd.js data-search-src=/js/third-party/search/algolia-search.js src=/js/third-party/search/algolia-search-loader.js></script><script defer src=/js/third-party/fancybox.js></script><noscript><link href=/css/noscript.css rel=stylesheet></noscript><link title="Nicksxs's Blog" href=/atom.xml rel=alternate type=application/atom+xml><body itemscope itemtype=http://schema.org/WebPage><div class=headband></div><main class=main><div class=column><header class=header itemscope itemtype=http://schema.org/WPHeader><div class=site-brand-container><div class=site-nav-toggle><div aria-label=切换导航栏 class=toggle role=button><span class=toggle-line></span><span class=toggle-line></span><span class=toggle-line></span></div></div><div class=site-meta><a class=brand href=/ rel=start><i class=logo-line></i><p class=site-title>Nicksxs's Blog</p><i class=logo-line></i></a><p class=site-subtitle itemprop=description>Java 运行时、生产诊断与 AI 工程实践</div><div class=site-nav-right><div class="toggle popup-trigger" aria-label=搜索 role=button><i class="fa fa-search fa-fw fa-lg"></i></div></div></div><nav class=site-nav><ul class="main-menu menu"><li class="menu-item menu-item-home"><a href=/ rel=section><i class="fa fa-home fa-fw"></i>首页</a><li class="menu-item menu-item-专题"><a href=/topics/ rel=section><i class="fa fa-layer-group fa-fw"></i>专题</a><li class="menu-item menu-item-工具"><a href=/tools/ rel=section><i class="fa fa-toolbox fa-fw"></i>工具</a><li class="menu-item menu-item-about"><a href=/about/ rel=section><i class="fa fa-user fa-fw"></i>关于我</a><li class="menu-item menu-item-tags"><a href=/tags/ rel=section><i class="fa fa-tags fa-fw"></i>标签</a><li class="menu-item menu-item-categories"><a href=/categories/ rel=section><i class="fa fa-th fa-fw"></i>分类</a><li class="menu-item menu-item-archives"><a href=/archives/ rel=section><i class="fa fa-archive fa-fw"></i>归档</a><li class="menu-item menu-item-search"><a class=popup-trigger role=button><i class="fa fa-search fa-fw"></i>搜索</a></ul></nav><div class=search-pop-overlay><div class="popup search-popup"><div class=search-header><span class=search-icon><i class="fa fa-search"></i></span><div class=search-input-container><input autocapitalize=off autocomplete=off class=search-input maxlength=80 placeholder=搜索... spellcheck=false type=search></div><span class=popup-btn-close role=button><i class="fa fa-times-circle"></i></span></div><div class=search-result-container><div class=search-result-icon><i class="fab fa-algolia fa-5x"></i></div></div></div></div></header><aside class=sidebar><div class="sidebar-inner sidebar-overview-active"><ul class=sidebar-nav><li class=sidebar-nav-toc>文章目录<li class=sidebar-nav-overview>站点概览</ul><div class=sidebar-panel-container><div class="post-toc-wrap sidebar-panel"></div><div class="site-overview-wrap sidebar-panel"><div class="site-author animated" itemprop=author itemscope itemtype=http://schema.org/Person><img alt=Nicksxs class=site-author-image itemprop=image src=/uploads/avatar.jpg><p class=site-author-name itemprop=name>Nicksxs<div class=site-description itemprop=description>Nicksxs 的技术博客,深入 Java 运行时与生产诊断、低成本大模型推理和 Agent 工程实践。</div></div><div class="site-state-wrap animated"><nav class=site-state><div class="site-state-item site-state-posts"><a href=/archives/><span class=site-state-item-count>388</span> <span class=site-state-item-name>日志</span></a></div><div class="site-state-item site-state-categories"><a href=/categories/><span class=site-state-item-count>179</span> <span class=site-state-item-name>分类</span></a></div><div class="site-state-item site-state-tags"><a href=/tags/><span class=site-state-item-count>329</span> <span class=site-state-item-name>标签</span></a></div></nav></div><div class="links-of-author animated"><span class=links-of-author-item><a rel="noopener me" title="GitHub → https://github.com/nicksxs" href=https://github.com/nicksxs target=_blank><i class="fab fa-github fa-fw"></i>GitHub</a> </span><span class=links-of-author-item><a rel="noopener me" title="E-Mail → mailto:nicksxs1202@gmail.com" href=mailto:nicksxs1202@gmail.com target=_blank><i class="fa fa-envelope fa-fw"></i>E-Mail</a></span></div><div class="cc-license animated" itemprop=license><a class=cc-opacity href=https://creativecommons.org/licenses/by-nc-sa/4.0/ rel=noopener target=_blank><img alt="Creative Commons" src=https://cdnjs.cloudflare.com/ajax/libs/creativecommons-vocabulary/2020.11.3/assets/license_badges/small/by_nc_sa.svg></a></div><div class="widget-wrap sidebar-tag-cloud"><div class=tag-cloud-tags><a class=tag-cloud-10 href=/tags/Java/ style=font-size:16px>Java</a><a class=tag-cloud-9 href=/tags/leetcode/ style=font-size:15.64px>leetcode</a><a class=tag-cloud-9 href=/tags/%E7%94%9F%E6%B4%BB/ style=font-size:15.29px>生活</a><a class=tag-cloud-8 href=/tags/LLM/ style=font-size:14.93px>LLM</a><a class=tag-cloud-7 href=/tags/%E9%A2%98%E8%A7%A3/ style=font-size:14.57px>题解</a><a class=tag-cloud-6 href=/tags/SpringBoot/ style=font-size:14.21px>SpringBoot</a><a class=tag-cloud-6 href=/tags/MySQL/ style=font-size:14.21px>MySQL</a><a class=tag-cloud-6 href=/tags/C/ style=font-size:13.86px>C++</a><a class=tag-cloud-5 href=/tags/Redis/ style=font-size:13.5px>Redis</a><a class=tag-cloud-4 href=/tags/Tomcat/ style=font-size:13.14px>Tomcat</a><a class=tag-cloud-4 href=/tags/Mybatis/ style=font-size:13.14px>Mybatis</a><a class=tag-cloud-4 href=/tags/%E5%B0%8F%E6%8A%80%E5%B7%A7/ style=font-size:12.79px>小技巧</a><a class=tag-cloud-3 href=/tags/%E6%95%B0%E6%8D%AE%E7%BB%93%E6%9E%84/ style=font-size:12.43px>数据结构</a><a class=tag-cloud-3 href=/tags/%E6%BA%90%E7%A0%81/ style=font-size:12.43px>源码</a><a class=tag-cloud-2 href=/tags/MQ/ style=font-size:12.07px>MQ</a><a class=tag-cloud-2 href=/tags/%E6%B6%88%E6%81%AF%E9%98%9F%E5%88%97/ style=font-size:12.07px>消息队列</a><a class=tag-cloud-2 href=/tags/RocketMQ/ style=font-size:12.07px>RocketMQ</a><a class=tag-cloud-2 href=/tags/%E8%BF%90%E5%8A%A8/ style=font-size:12.07px>运动</a><a class=tag-cloud-1 href=/tags/php/ style=font-size:11.71px>php</a><a class=tag-cloud-1 href=/tags/Spring/ style=font-size:11.36px>Spring</a><a class=tag-cloud-1 href=/tags/linux/ style=font-size:11.36px>linux</a><a class=tag-cloud-1 href=/tags/%E5%87%8F%E8%82%A5/ style=font-size:11.36px>减肥</a><a class=tag-cloud-1 href=/tags/%E8%B7%91%E6%AD%A5/ style=font-size:11.36px>跑步</a><a class=tag-cloud-0 href=/tags/Dubbo/ style=font-size:11px>Dubbo</a></div></div><div class="affiliate-creative affiliate-creative--sidebar" data-affiliate-id=tencent-cloud-general><a rel="sponsored noopener" aria-label=腾讯云产品优惠 href=https://cloud.tencent.com/act/cps/redirect?redirect=2446&cps_key=2e33a1eedb380997d03618b4a5ba6ca7&from=console target=_blank><img alt=腾讯云服务器、数据库和云产品优惠 decoding=async height=419 loading=lazy src=/uploads/affiliate/tencent-cloud-general.webp width=690> </a><span class=affiliate-disclosure>推广</span></div></div></div></div><div class="sidebar-inner sidebar-blogroll"><div class="links-of-blogroll animated"><div class=links-of-blogroll-title><i class="fa fa-globe fa-fw"></i> 链接</div><ul class=links-of-blogroll-list><li class=links-of-blogroll-item><a href=https://covermusic.cn/ rel=noopener target=_blank title=https://covermusic.cn>69伙伴</a></ul></div></div></aside></div><div class="main-inner post posts-expand"><div class=post-block><article class=post-content itemscope itemtype=http://schema.org/Article lang=zh-CN><link href=https://nicksxs.me/2020/09/06/mybatis-%E7%9A%84-%E5%92%8C-%E6%98%AF%E6%9C%89%E5%95%A5%E5%8C%BA%E5%88%AB/ itemprop=mainEntityOfPage><span hidden itemprop=author itemscope itemtype=http://schema.org/Person><meta content=/uploads/avatar.jpg itemprop=image><meta content=Nicksxs itemprop=name></span><span hidden itemprop=publisher itemscope itemtype=http://schema.org/Organization><meta content="Nicksxs's Blog" itemprop=name><meta content="Nicksxs 的技术博客,深入 Java 运行时与生产诊断、低成本大模型推理和 Agent 工程实践。" itemprop=description></span><span hidden itemprop=post itemscope itemtype=http://schema.org/CreativeWork><meta content="mybatis 的 $ 和 # 是有啥区别 | Nicksxs's Blog" itemprop=name><meta content="本文从 MyBatis 源码和 SQL 解析过程说明 #{} 与 ${} 的区别,分析预编译参数、字符串替换、动态 SQL、适用场景以及 SQL 注入风险。" itemprop=description></span><header class=post-header><h1 itemprop="name headline" class=post-title>mybatis 的 $ 和 # 是有啥区别</h1><div class=post-meta-container><div class=post-meta><span class=post-meta-item><span class=post-meta-item-icon><i class="far fa-calendar"></i> </span><span class=post-meta-item-text>发表于</span> <time itemprop="dateCreated datePublished" title="创建时间:2020-09-06 23:14:50" datetime=2020-09-06T23:14:50+08:00>2020-09-06</time> </span><span class=post-meta-item><span class=post-meta-item-icon><i class="far fa-folder"></i> </span><span class=post-meta-item-text>分类于</span> <span itemprop=about itemscope itemtype=http://schema.org/Thing><a href=/categories/Java/ itemprop=url rel=index><span itemprop=name>Java</span></a> </span>, <span itemprop=about itemscope itemtype=http://schema.org/Thing><a href=/categories/Java/Mybatis/ itemprop=url rel=index><span itemprop=name>Mybatis</span></a> </span>, <span itemprop=about itemscope itemtype=http://schema.org/Thing><a href=/categories/Mysql/ itemprop=url rel=index><span itemprop=name>Mysql</span></a> </span>, <span itemprop=about itemscope itemtype=http://schema.org/Thing><a href=/categories/Spring/ itemprop=url rel=index><span itemprop=name>Spring</span></a> </span>, <span itemprop=about itemscope itemtype=http://schema.org/Thing><a href=/categories/Mysql/Sql%E6%B3%A8%E5%85%A5/ itemprop=url rel=index><span itemprop=name>Sql注入</span></a> </span>, <span itemprop=about itemscope itemtype=http://schema.org/Thing><a href=/categories/Spring/Mybatis/ itemprop=url rel=index><span itemprop=name>Mybatis</span></a> </span></span><span class="post-meta-item cloudflare-page-counter" data-title="mybatis 的 $ 和 # 是有啥区别" data-increment=true data-path=/2020/09/06/mybatis-%E7%9A%84-%E5%92%8C-%E6%98%AF%E6%9C%89%E5%95%A5%E5%8C%BA%E5%88%AB/ title=阅读次数><span class=post-meta-item-icon><i class="far fa-eye"></i> </span><span class=post-meta-item-text>阅读次数:</span> <span class=cloudflare-page-counter-count></span></span></div><div class=post-description>本文从 MyBatis 源码和 SQL 解析过程说明 #{} 与 ${} 的区别,分析预编译参数、字符串替换、动态 SQL、适用场景以及 SQL 注入风险。</div></div></header><div class=post-body itemprop=articleBody><p>这个问题也是面试中常被问到的,就抽空来了解下这个,跳过一大段前面初始化的逻辑,<br>对于一条<code>select * from t1 where id = #{id}</code>这样的 sql,在初始化扫描 mapper 的xml文件的时候会根据是否是 dynamic 来判断生成 DynamicSqlSource 还是 RawSqlSource,这里它是一条 RawSqlSource,<br>在这里做了替换,将<code>#{}</code>替换成了<code>?</code><br><img loading=lazy src=https://img.nicksxs.me/uPic/c84r0g.png><br>前面说的是否 dynamic 就是在这里进行判断<br><img loading=lazy src=https://img.nicksxs.me/uPic/E0ODcp.png><figure class="highlight java"><table><tr><td class=gutter><pre><span class=line>1</span><br><span class=line>2</span><br><span class=line>3</span><br><span class=line>4</span><br><span class=line>5</span><br><span class=line>6</span><br><span class=line>7</span><br><span class=line>8</span><br><span class=line>9</span><br><span class=line>10</span><br><span class=line>11</span><br><span class=line>12</span><br><span class=line>13</span><br><span class=line>14</span><br><span class=line>15</span><br><span class=line>16</span><br><span class=line>17</span><br><span class=line>18</span><br><span class=line>19</span><br><span class=line>20</span><br><span class=line>21</span><br><span class=line>22</span><br><span class=line>23</span><br><span class=line>24</span><br><span class=line>25</span><br><span class=line>26</span><br><span class=line>27</span><br><span class=line>28</span><br><span class=line>29</span><br><span class=line>30</span><br><span class=line>31</span><br><span class=line>32</span><br><span class=line>33</span><br><span class=line>34</span><br><span class=line>35</span><br><span class=line>36</span><br><span class=line>37</span><br><span class=line>38</span><br><span class=line>39</span><br><span class=line>40</span><br><span class=line>41</span><br><span class=line>42</span><br><span class=line>43</span><br><span class=line>44</span><br><span class=line>45</span><br><span class=line>46</span><br><span class=line>47</span><br><span class=line>48</span><br></pre><td class=code><pre><span class=line><span class=comment>// org.apache.ibatis.scripting.xmltags.XMLScriptBuilder#parseScriptNode</span></span><br><span class=line><span class=keyword>public</span> SqlSource <span class="title function_">parseScriptNode</span><span class=params>()</span> {</span><br><span class=line> <span class=type>MixedSqlNode</span> <span class=variable>rootSqlNode</span> <span class=operator>=</span> parseDynamicTags(context);</span><br><span class=line> SqlSource sqlSource;</span><br><span class=line> <span class=keyword>if</span> (isDynamic) {</span><br><span class=line> sqlSource = <span class=keyword>new</span> <span class="title class_">DynamicSqlSource</span>(configuration, rootSqlNode);</span><br><span class=line> } <span class=keyword>else</span> {</span><br><span class=line> sqlSource = <span class=keyword>new</span> <span class="title class_">RawSqlSource</span>(configuration, rootSqlNode, parameterType);</span><br><span class=line> }</span><br><span class=line> <span class=keyword>return</span> sqlSource;</span><br><span class=line> }</span><br><span class=line><span class=comment>// org.apache.ibatis.scripting.xmltags.XMLScriptBuilder#parseDynamicTags</span></span><br><span class=line><span class=keyword>protected</span> MixedSqlNode <span class="title function_">parseDynamicTags</span><span class=params>(XNode node)</span> {</span><br><span class=line> List<SqlNode> contents = <span class=keyword>new</span> <span class="title class_">ArrayList</span><>();</span><br><span class=line> <span class=type>NodeList</span> <span class=variable>children</span> <span class=operator>=</span> node.getNode().getChildNodes();</span><br><span class=line> <span class=keyword>for</span> (<span class=type>int</span> <span class=variable>i</span> <span class=operator>=</span> <span class=number>0</span>; i < children.getLength(); i++) {</span><br><span class=line> <span class=type>XNode</span> <span class=variable>child</span> <span class=operator>=</span> node.newXNode(children.item(i));</span><br><span class=line> <span class=keyword>if</span> (child.getNode().getNodeType() == Node.CDATA_SECTION_NODE || child.getNode().getNodeType() == Node.TEXT_NODE) {</span><br><span class=line> <span class=type>String</span> <span class=variable>data</span> <span class=operator>=</span> child.getStringBody(<span class=string>""</span>);</span><br><span class=line> <span class=type>TextSqlNode</span> <span class=variable>textSqlNode</span> <span class=operator>=</span> <span class=keyword>new</span> <span class="title class_">TextSqlNode</span>(data);</span><br><span class=line> <span class=keyword>if</span> (textSqlNode.isDynamic()) {</span><br><span class=line> contents.add(textSqlNode);</span><br><span class=line> isDynamic = <span class=literal>true</span>;</span><br><span class=line> } <span class=keyword>else</span> {</span><br><span class=line> contents.add(<span class=keyword>new</span> <span class="title class_">StaticTextSqlNode</span>(data));</span><br><span class=line> }</span><br><span class=line> } <span class=keyword>else</span> <span class=keyword>if</span> (child.getNode().getNodeType() == Node.ELEMENT_NODE) { <span class=comment>// issue #628</span></span><br><span class=line> <span class=type>String</span> <span class=variable>nodeName</span> <span class=operator>=</span> child.getNode().getNodeName();</span><br><span class=line> <span class=type>NodeHandler</span> <span class=variable>handler</span> <span class=operator>=</span> nodeHandlerMap.get(nodeName);</span><br><span class=line> <span class=keyword>if</span> (handler == <span class=literal>null</span>) {</span><br><span class=line> <span class=keyword>throw</span> <span class=keyword>new</span> <span class="title class_">BuilderException</span>(<span class=string>"Unknown element <"</span> + nodeName + <span class=string>"> in SQL statement."</span>);</span><br><span class=line> }</span><br><span class=line> handler.handleNode(child, contents);</span><br><span class=line> isDynamic = <span class=literal>true</span>;</span><br><span class=line> }</span><br><span class=line> }</span><br><span class=line> <span class=keyword>return</span> <span class=keyword>new</span> <span class="title class_">MixedSqlNode</span>(contents);</span><br><span class=line> }</span><br><span class=line><span class=comment>// org.apache.ibatis.scripting.xmltags.TextSqlNode#isDynamic</span></span><br><span class=line> <span class=keyword>public</span> <span class=type>boolean</span> <span class="title function_">isDynamic</span><span class=params>()</span> {</span><br><span class=line> <span class=type>DynamicCheckerTokenParser</span> <span class=variable>checker</span> <span class=operator>=</span> <span class=keyword>new</span> <span class="title class_">DynamicCheckerTokenParser</span>();</span><br><span class=line> <span class=type>GenericTokenParser</span> <span class=variable>parser</span> <span class=operator>=</span> createParser(checker);</span><br><span class=line> parser.parse(text);</span><br><span class=line> <span class=keyword>return</span> checker.isDynamic();</span><br><span class=line> }</span><br><span class=line> <span class=keyword>private</span> GenericTokenParser <span class="title function_">createParser</span><span class=params>(TokenHandler handler)</span> {</span><br><span class=line> <span class=keyword>return</span> <span class=keyword>new</span> <span class="title class_">GenericTokenParser</span>(<span class=string>"${"</span>, <span class=string>"}"</span>, handler);</span><br><span class=line> }</span><br></pre></table></figure><p>可以看到其中一个条件就是是否有<code>${}</code>这种占位符,假如说上面的 sql 换成 <code>${}</code>,那么可以看到它会在这里创建一个 dynamicSqlSource,<figure class="highlight java"><table><tr><td class=gutter><pre><span class=line>1</span><br><span class=line>2</span><br><span class=line>3</span><br><span class=line>4</span><br><span class=line>5</span><br><span class=line>6</span><br><span class=line>7</span><br><span class=line>8</span><br><span class=line>9</span><br><span class=line>10</span><br><span class=line>11</span><br><span class=line>12</span><br><span class=line>13</span><br><span class=line>14</span><br><span class=line>15</span><br><span class=line>16</span><br><span class=line>17</span><br><span class=line>18</span><br><span class=line>19</span><br><span class=line>20</span><br><span class=line>21</span><br><span class=line>22</span><br><span class=line>23</span><br><span class=line>24</span><br><span class=line>25</span><br></pre><td class=code><pre><span class=line><span class=comment>// org.apache.ibatis.scripting.xmltags.DynamicSqlSource</span></span><br><span class=line><span class=keyword>public</span> <span class=keyword>class</span> <span class="title class_">DynamicSqlSource</span> <span class=keyword>implements</span> <span class="title class_">SqlSource</span> {</span><br><span class=line></span><br><span class=line> <span class=keyword>private</span> <span class=keyword>final</span> Configuration configuration;</span><br><span class=line> <span class=keyword>private</span> <span class=keyword>final</span> SqlNode rootSqlNode;</span><br><span class=line></span><br><span class=line> <span class=keyword>public</span> <span class="title function_">DynamicSqlSource</span><span class=params>(Configuration configuration, SqlNode rootSqlNode)</span> {</span><br><span class=line> <span class=built_in>this</span>.configuration = configuration;</span><br><span class=line> <span class=built_in>this</span>.rootSqlNode = rootSqlNode;</span><br><span class=line> }</span><br><span class=line></span><br><span class=line> <span class=meta>@Override</span></span><br><span class=line> <span class=keyword>public</span> BoundSql <span class="title function_">getBoundSql</span><span class=params>(Object parameterObject)</span> {</span><br><span class=line> <span class=type>DynamicContext</span> <span class=variable>context</span> <span class=operator>=</span> <span class=keyword>new</span> <span class="title class_">DynamicContext</span>(configuration, parameterObject);</span><br><span class=line> rootSqlNode.apply(context);</span><br><span class=line> <span class=type>SqlSourceBuilder</span> <span class=variable>sqlSourceParser</span> <span class=operator>=</span> <span class=keyword>new</span> <span class="title class_">SqlSourceBuilder</span>(configuration);</span><br><span class=line> Class<?> parameterType = parameterObject == <span class=literal>null</span> ? Object.class : parameterObject.getClass();</span><br><span class=line> <span class=type>SqlSource</span> <span class=variable>sqlSource</span> <span class=operator>=</span> sqlSourceParser.parse(context.getSql(), parameterType, context.getBindings());</span><br><span class=line> <span class=type>BoundSql</span> <span class=variable>boundSql</span> <span class=operator>=</span> sqlSource.getBoundSql(parameterObject);</span><br><span class=line> context.getBindings().forEach(boundSql::setAdditionalParameter);</span><br><span class=line> <span class=keyword>return</span> boundSql;</span><br><span class=line> }</span><br><span class=line></span><br><span class=line>}</span><br><span class=line></span><br></pre></table></figure><p>这里眼尖的同学可能就可以看出来了,RawSqlSource 在初始化的时候已经经过了 parse,把<code>#{}</code>替换成了<code>?</code>占位符,但是 DynamicSqlSource 并没有<br><img loading=lazy src=https://img.nicksxs.me/uPic/dnZWP7.png>再看这个图,我们发现在这的时候还没有进行替换<br>然后往里跟<br><img loading=lazy src=https://img.nicksxs.me/uPic/YGVD0P.png>好像是这里了<br><img loading=lazy src=https://img.nicksxs.me/uPic/BWHuUO.png><br>这里 rootSqlNode.apply 其实是一个对原来 sql 的解析结果的一个循环调用,不同类型的标签会构成不同的 node,像这里就是一个 textSqlNode<br><img loading=lazy src=https://img.nicksxs.me/uPic/eTiQm6.png><br>可以发现到这我们的 sql 已经被替换了,而且是直接作为 string 类型替换的,所以可以明白了这个问题所在,就是注入,不过细心的同学发现其实这里是有个<br><img loading=lazy src=https://img.nicksxs.me/uPic/Cc4JPw.png><br>理论上还是可以做过滤的,不过好像现在没用起来。<br>我们前面可以发现对于<code>#{}</code>是在启动扫描 mapper的 xml 文件就替换成了 <code>?</code>,然后是在什么时候变成实际的值的呢<br><img loading=lazy src=https://img.nicksxs.me/uPic/fRHpNO.png><br>发现到这的时候还是没有替换,其实说白了也就是 prepareStatement 那一套,<br><img loading=lazy src=https://img.nicksxs.me/uPic/4tNU7f.png><br>在这里进行替换,会拿到 org.apache.ibatis.mapping.ParameterMapping,然后进行替换,因为会带着类型信息,所以不用担心注入咯</div><footer class=post-footer><div class="affiliate-creative affiliate-creative--post-end" data-affiliate-id=tencent-cloud-general><a rel="sponsored noopener" aria-label=腾讯云产品优惠 href=https://cloud.tencent.com/act/cps/redirect?redirect=2446&cps_key=2e33a1eedb380997d03618b4a5ba6ca7&from=console target=_blank><img alt=腾讯云服务器、数据库和云产品优惠 decoding=async height=419 loading=lazy src=/uploads/affiliate/tencent-cloud-general.webp width=690> </a><span class=affiliate-disclosure>推广</span></div><div class=reward-container><div>请我一杯咖啡吧!</div><button>赞赏</button><div class=post-reward><div><img alt="Nicksxs 微信" src=https://i.loli.net/2020/01/12/NUlWanT31E8LQGx.png><span>微信</span></div><div><img alt="Nicksxs 支付宝" src=https://ooo.0o0.ooo/2016/08/17/57b421e773057.jpg><span>支付宝</span></div></div></div><div class=post-copyright><ul><li class=post-copyright-author><strong>本文作者: </strong>Nicksxs<li class=post-copyright-link><strong>本文链接:</strong> <a title="mybatis 的 $ 和 # 是有啥区别" href=https://nicksxs.me/2020/09/06/mybatis-%E7%9A%84-%E5%92%8C-%E6%98%AF%E6%9C%89%E5%95%A5%E5%8C%BA%E5%88%AB/>https://nicksxs.me/2020/09/06/mybatis-的-和-是有啥区别/</a><li class=post-copyright-license><strong>版权声明: </strong>本博客所有文章除特别声明外,均采用 <a href=https://creativecommons.org/licenses/by-nc-sa/4.0/ rel=noopener target=_blank><i class="fab fa-fw fa-creative-commons"></i>BY-NC-SA</a> 许可协议。转载请注明出处!</ul></div><div class=post-tags><a href=/tags/Java/ rel=tag># Java</a><a href=/tags/Mysql/ rel=tag># Mysql</a><a href=/tags/Mybatis/ rel=tag># Mybatis</a><a href=/tags/Sql%E6%B3%A8%E5%85%A5/ rel=tag># Sql注入</a></div><div class=post-nav><div class=post-nav-item><a href=/2020/08/30/%E8%BF%99%E5%91%A8%E6%9C%AB%E6%88%91%E5%8F%88%E5%9C%A8%E8%80%81%E4%B8%88%E4%BA%BA%E5%AE%B6%E6%89%93%E4%BA%86%E5%A4%A9%E5%B0%8F%E5%B7%A5/ rel=prev title=这周末我又在老丈人家打了天小工><i class="fa fa-angle-left"></i> 这周末我又在老丈人家打了天小工</a></div><div class=post-nav-item><a href=/2020/09/13/%E5%9C%A8%E8%80%81%E4%B8%88%E4%BA%BA%E5%AE%B6%E7%9A%84%E5%B0%8F%E5%B7%A5%E8%AE%B0%E4%B8%89/ rel=next title=在老丈人家的小工记三>在老丈人家的小工记三 <i class="fa fa-angle-right"></i></a></div></div></footer></article></div><div class=comments id=disqus_thread><noscript>Please enable JavaScript to view the comments powered by Disqus.</noscript></div></div></main><footer class=footer><div class=footer-inner><div class=beian><a href=https://beian.miit.gov.cn/ rel=noopener target=_blank>浙ICP备16002580号-2 </a><img alt src=/uploads/beian.png><a href=https://beian.mps.gov.cn/#/query/webSearch?code=33010602011094 rel=noopener target=_blank>浙公网安备 33010602011094号</a></div><div class=copyright>© <span itemprop=copyrightYear>2026</span><span class=with-love><i class="fa fa-heart"></i> </span><span class=author itemprop=copyrightHolder>Nicksxs</span></div></div></footer><div class="toggle sidebar-toggle" role=button><span class=toggle-line></span><span class=toggle-line></span><span class=toggle-line></span></div><div class=sidebar-dimmer></div><div aria-label=返回顶部 class=back-to-top role=button><i class="fa fa-arrow-up fa-lg"></i><span>0%</span></div><a aria-label="在 GitHub 上关注我" title="在 GitHub 上关注我" class=github-corner href=https://github.com/nicksxs rel=noopener target=_blank><svg viewbox="0 0 250 250" aria-hidden=true height=80 width=80><path d="M0,0 L115,115 L130,115 L142,142 L250,250 L250,0 Z"></path><path d="M128.3,109.0 C113.8,99.7 119.0,89.6 119.0,89.6 C122.0,82.7 120.5,78.6 120.5,78.6 C119.2,72.0 123.4,76.3 123.4,76.3 C127.3,80.9 125.5,87.3 125.5,87.3 C122.9,97.6 130.6,101.9 134.4,103.2" style="transform-origin:130px 106px" class=octo-arm fill=currentColor></path><path d="M115.0,115.0 C114.9,115.1 118.7,116.5 119.8,115.4 L133.7,101.6 C136.9,99.2 139.9,98.4 142.2,98.6 C133.8,88.0 127.5,74.4 143.8,58.0 C148.5,53.4 154.0,51.2 159.7,51.0 C160.3,49.4 163.2,43.6 171.4,40.1 C171.4,40.1 176.1,42.5 178.8,56.2 C183.1,58.6 187.2,61.8 190.9,65.4 C194.5,69.0 197.7,73.2 200.1,77.6 C213.8,80.2 216.3,84.9 216.3,84.9 C212.7,93.1 206.9,96.0 205.4,96.6 C205.1,102.4 203.0,107.8 198.3,112.5 C181.9,128.9 168.3,122.5 157.7,114.1 C157.9,116.9 156.7,120.9 152.7,124.9 L141.0,136.5 C139.8,137.7 141.6,141.9 141.8,141.8 Z" class=octo-body fill=currentColor></path></svg></a><noscript><div class=noscript-warning>Theme NexT works best with JavaScript enabled</div></noscript><script data-cloudflare-page-counter-config type=application/json>{"enable":true,"endpoint":"https://counter.nicksxs.me","site":"nicksxs","local_cache":true,"timeout":5000,"icon":"far fa-eye","item_text":true}</script><script src=/js/cloudflare-page-counter.js></script><script class=next-config data-name=disqus type=application/json>{"enable":true,"shortname":"nicksxs","count":false,"i18n":{"disqus":"disqus"}}</script><script defer src=/js/third-party/comments/disqus.js></script>
|