// 傳統(tǒng)方式需要手動(dòng)拼接SQL字符串
StringBuilder sql = new StringBuilder("SELECT * FROM user WHERE 1=1");
if (user.getId() != null) {
    sql.append(" AND id = ").append(user.getId());
}
if (user.getUsername() != null) {
    sql.append(" AND username = '").append(user.getUsername()).append("'");
}
// 存在SQL注入風(fēng)險(xiǎn)！且代碼冗長難維護(hù)

<select id="findUsers" parameterType="User" resultType="User">
    SELECT * FROM user
    <where>
        <if test="id != null">
            AND id = #{id}
        </if>
        <if test="username != null and username != ''">
            AND username = #{username}
        </if>
        <if test="password != null">
            AND password = #{password}
        </if>
        <if test="age != null">
            AND age = #{age}
        </if>
    </where>
</select>

<!-- 當(dāng)所有if都不滿足時(shí)，SQL會(huì)變成：SELECT * FROM user WHERE -->
SELECT * FROM user
WHERE
    <if test="id != null">id = #{id}</if>

SELECT * FROM user
<where>
    <if test="id != null">id = #{id}</if>
    <!-- 其他條件... -->
</where>

// 創(chuàng)建參數(shù)對象
User queryParams = new User();
queryParams.setId(1);
queryParams.setPassword("securePass123");

// 執(zhí)行動(dòng)態(tài)查詢
UserRepository repo = sqlSession.getMapper(UserRepository.class);
User result = repo.get(queryParams);

SELECT * FROM user 
WHERE 
    id = ? 
    AND password = ?

<!-- 增加空字符串檢查 -->
<if test="username != null and username != ''">

<if test="@org.apache.commons.lang3.StringUtils@isNotBlank(email)">
    AND email = #{email}
</if>

<select id="searchUsers">
    SELECT * FROM users
    <where>
        <choose>
            <when test="status != null">
                status = #{status}
            </when>
            <otherwise>
                status = 'ACTIVE'
            </otherwise>
        </choose>
        <if test="name != null">
            AND (first_name LIKE #{name} OR last_name LIKE #{name})
        </if>
    </where>
    ORDER BY
    <foreach item="item" collection="sortBy" separator=",">
        ${item}
    </foreach>
</select>

<!-- 使用<bind>預(yù)先處理值 -->
<bind name="pattern" value="'%' + name + '%'" />
<if test="name != null">
    AND username LIKE #{pattern}
</if>

// 輸出動(dòng)態(tài)SQL
configuration.setLogImpl(StdOutImpl.class);

// 監(jiān)控結(jié)果
DEBUG [main] - ==>  Preparing: SELECT * FROM user WHERE id = ? 
DEBUG [main] - ==> Parameters: 1(Integer)