mybatis 模糊查询

方法一, 推荐
select * from user where username like CONCAT('%',#{username},'%')
方法二, 存在sql注入危险
select * from user where username like '%${username}%'