Scenario introduction:
The parameter passed to the dao layer is an SQL string, and it is required to execute this SQL string in mapper.xml to return the result.
It can be achieved using ${sqlstr}, but there is an injection risk.
Solution:
Execute using SQL code blocks.
< Select id=" SelectSql" ParameterType" Java. lang. String" ResultType" Java. util. Map">
Begin.
Declare @Sqlstr nvarchar (2000);
Set @Sqlstr=# {SQL, jdbcType= VARCHAR}.
Execute ( @sqlstr);
End;
</ Select>
Among them, the parameter SQL in # {} is the passed in parameter key.