<selectid="searchStudents"resultType="com.example.entity.StudentEntity" parameterType="com.example.entity.StudentEntity"> SELECT * FROM test_student <where> <iftest="age != null and age != '' and compare != null and compare != ''"> age ${compare} #{age} </if> <iftest="name != null and name != ''"> AND name LIKE '%#{name}%' </if> <iftest="address != null and address != ''"> AND address LIKE '%#{address}%' </if> </where> ORDER BY id </select>
<selectid="searchStudents"resultType="com.example.entity.StudentEntity" parameterType="com.example.entity.StudentEntity"> SELECT * FROM test_student <where> <iftest="age != null and age != '' and compare != null and compare != ''"> age ${compare} #{age} </if> <iftest="name != null and name != ''"> AND name LIKE '%${name}%' </if> <iftest="address != null and address != ''"> AND address LIKE '%${address}%' </if> </where> ORDER BY id </select>
查询结果如下图:
注:使用${…}不能有效防止SQL注入,所以这种方式虽然简单但是不推荐使用!!!
把'%#{name}%'改为"%"#{name}"%"
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
<selectid="searchStudents"resultType="com.example.entity.StudentEntity" parameterType="com.example.entity.StudentEntity"> SELECT * FROM test_student <where> <iftest="age != null and age != '' and compare != null and compare != ''"> age ${compare} #{age} </if> <iftest="name != null and name != ''"> AND name LIKE "%"#{name}"%" </if> <iftest="address != null and address != ''"> AND address LIKE "%"#{address}"%" </if> </where> ORDER BY id </select>
查询结果:
使用sql中的字符串拼接函数
1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18
<selectid="searchStudents"resultType="com.example.entity.StudentEntity" parameterType="com.example.entity.StudentEntity"> SELECT * FROM test_student <where> <iftest="age != null and age != '' and compare != null and compare != ''"> age ${compare} #{age} </if> <iftest="name != null and name != ''"> AND name LIKE CONCAT(CONCAT('%',#{name},'%')) </if> <iftest="address != null and address != ''"> AND address LIKE CONCAT(CONCAT('%',#{address},'%')) </if> </where> ORDER BY id </select>
<selectid="searchStudents"resultType="com.example.entity.StudentEntity" parameterType="com.example.entity.StudentEntity"> <bindname="pattern1"value="'%' + _parameter.name + '%'" /> <bindname="pattern2"value="'%' + _parameter.address + '%'" /> SELECT * FROM test_student <where> <iftest="age != null and age != '' and compare != null and compare != ''"> age ${compare} #{age} </if> <iftest="name != null and name != ''"> AND name LIKE #{pattern1} </if> <iftest="address != null and address != ''"> AND address LIKE #{pattern2} </if> </where> ORDER BY id </select>
publicstaticvoidmain(String[] args){ try { int count = 500;
long begin = System.currentTimeMillis(); testString(count); long end = System.currentTimeMillis(); long time = end - begin; System.out.println("String 方法拼接"+count+"次消耗时间:" + time + "毫秒");
begin = System.currentTimeMillis(); testStringBuilder(count); end = System.currentTimeMillis(); time = end - begin; System.out.println("StringBuilder 方法拼接"+count+"次消耗时间:" + time + "毫秒");
} catch (Exception e) { e.printStackTrace(); }
}
privatestatic String testString(int count){ String result = "";
for (int i = 0; i < count; i++) { result += "hello "; }
return result; }
privatestatic String testStringBuilder(int count){ StringBuilder sb = new StringBuilder();
for (int i = 0; i < count; i++) { sb.append("hello"); }