mybatis模糊查詢防止sql注入的方法：
bind + #{}模糊查詢可以防止SQL注入，bind元素可以從OGNL表達式中創建一個變量并將其綁定到上下文，例如：
<select id="selectBlogsLike" resultType="Blog">
<bind name="pattern" value="'%' + _parameter.getTitle() + '%'" />
SELECT * FROM BLOG
WHERE title LIKE #{pattern}
</select>
sql：
<select id="getInfo" resultType="cn.xm.exam.bean.haul.Haulinfo"
parameterType="hashmap">
SELECT * FROM haulinfo
<where>
<if test="name != null">
<bind name="names" value="'%'+name+'%'" />
and bigname like #{names}
</if>
<if test="status != null">
and bigStatus = #{status}
</if>
</where>
</select>
java測試方法：
@Test
public void test1() throws SQLException {
Map condition = new HashMap();
condition.put("name", "%' and bigdescription like '陽城");
condition.put("status", "未開始");
testMapper.getInfo(condition);
}
