dawei
mybatis本身的说明：
By default,using the #{} syntax will cause MyBatis to generate PreparedStatement properties and set the values safely against the PreparedStatement parameters (e.g. ?). While this is safer,faster and almost always preferred,sometimes you just want to directly inject a string unmodified into the SQL Statement. For example,for ORDER BY,<span style=”color: #000000;”> you might use something like this:
ORDER BY ${columnName}
Here MyBatis won’t modify or escape the string.
NOTE It’s not safe to accept input from a user and supply it to a statement unmodified in this way. This leads to potential SQL Injection attacks and therefore you should either disallow user input in these fields,or always perform your own escapes and checks.
从上文可以看出：
1. 使用#{}格式的语法在mybatis中使用Preparement语句来安全的设置值，执行sql类似下面的：
PreparedStatement ps =1,id);
此时MyBatis 不会修改或转义字符串。
这种方式类似于：
Statement st = ResultSet rs </span>= st.executeQuery(sql);</pre>
参考文献：
【1】http://mybatis.github.io/mybatis-3/sqlmap-xml.html
【2】https://mybatis.github.io/mybatis-3/zh/sqlmap-xml.html
