What is the difference between $and pound number in mybatis?

#It is equivalent to adding double quotation marks to data, and $is equivalent to directly displaying data

1. # Treat the incoming data as a string and add a double quotation mark to the automatically incoming data. For example: order by # user_id #, if the value passed in is 111, the value parsed into sql is order by "111"; if the value passed in is id, the sql parsed into sql is order by "id"

2. $directly displays and generates the incoming data in sql. For example: order by $user_id $. If the value passed in is 111, the value parsed into sql is order by user_id. If the value passed in is id, the sql parsed into sql is order by id

3. # mode can prevent SQL injection to a large extent.

4. The $mode cannot prevent Sql injection.

5. The $method is generally used to pass in database objects, such as table names

6. Don't use $if you can use #

When using the order by dynamic parameter in MyBatis sorting, note that $is used instead of#

String Replacement

By default, using the # {} format syntax will cause MyBatis to create a preprocessed statement property and set a safe value (such as?) against it. This is very safe and fast. It is also the first choice. Sometimes you just want to insert an unchanged string directly into the SQL statement. For example, like ORDER BY, you can use it as follows:

ORDER BY ${columnName}

MyBatis does not modify or escape strings here.

Important: It is unsafe to accept the output from the user and provide it to the invariant string in the statement. This will lead to potential SQL injection attacks, so you should not allow users to enter these fields, or usually escape and check

#{} Used to query CRUD statements

${} is used for fuzzy query (remember to add%%)