mybatis的parameterType为map，map里带有多个list

我写这个主要是为了解决sql注入

原sql有sql注入，

 

 

 

结果：select req_msg_id from account_message_info where req_msg_id in ('1230','1231','1232','1233','1234') and user_card_no in('123','123','123','123','123') 

但是#直接替换的话，是只有一个字符串了，

结果：

select req_msg_id from account_message_info where req_msg_id in (?) and user_card_no in(?)
'1230','1231','1232','1233','1234'(String), '123','123','123','123','123'(String)

所以用foreach

 

 dao层

 

 service层

 

 结果为：

select req_msg_id from account_message_info where req_msg_id in ( ? , ? , ? , ? , ? ) and user_card_no in ( ? , ? , ? , ? , ? )
1230(String), 1231(String), 1232(String), 1233(String), 1234(String), 123(String), 123(String), 123(String), 123(String), 123(String)