Logo Questions Linux Laravel Mysql Ubuntu Git Menu
 

MyBatis String as Parameter

I want to use a String parameter for a Select Statement in MyBatis. My mapper.xml:

<select id="selectAll" parameterType="String" resultMap="fastXMLResultMap">
        SELECT CREATIONDATE, DOCUMENTID, TITEL, REGTITEL, INFORCEDATE, DOCTYPE
        FROM #{databBaseTable}
</select>

And the calling function:

public List<FastXMLObject> selectAll(String databBaseTable) {

    SqlSession session = sqlSessionFactory.openSession();

    System.out.println("Table: "+databBaseTable);

    try {
        List<FastXMLObject> list = session.selectList("FastXMLObject.selectAll",databBaseTable);
        return list;
    } finally {
        session.close();
    }
}

The string dataBaseTable is the name of the table of my database (who would have thought that) because I want to get data dynamically from verious tables.

But unfortunatelly this does not work: Error: ORA-00903: Ungültiger Tabellenname (invalid table name) but it isnt. When I print out the value of "databBaseTable" it is the exact name of the table. And when I write the name of the table to my mapper.xml without a variable it works. What do I do wrong?

like image 353
Metalhead89 Avatar asked Aug 01 '12 13:08

Metalhead89


People also ask

What is parameter type in MyBatis?

parameterType. The fully qualified class name or alias for the parameter that will be passed into this statement. This attribute is optional because MyBatis can calculate the TypeHandler to use out of the actual parameter passed to the statement. Default is unset .

How do I avoid SQL injection in MyBatis?

In general, you should consider using #{} for string substitution instead of ${} . This is because #{} causes Mybatis to create a preparedStatement which prevents SQLInjection compared to ${} which would inject unmodified string into SQL.

How do I configure MyBatis?

mappers tag Mapper XML file is the important file, which contains the mapped SQL statements. Mapper's element is used to configure the location of these mappers xml files in the configuration file of MyBatis (this element contains four attributes namely resources, url, class, and name).

What is the difference between hibernate and MyBatis?

Hibernate is an object-relational mapping framework (ORM) which maps Java classes to database tables. MyBatis is a persistence framework – not ORM. It maps SQL statements to Java methods.


2 Answers

Use ${dataBaseTable} instead of '#'. The difference is that '#' is used for PreparedStatement substitution. '$' is for direct String substitution.

However, if you do this, you can't pass the table name in as a parameter to the selectList() call. You need to set the table name as a property. Properties can be set by using the <properties> element in the MyBatis config.xml or directly in code by using Configuration.getVariables().

See the 'String Substitution' section in the MyBatis Docs.

like image 124
AngerClown Avatar answered Sep 23 '22 02:09

AngerClown


Ok I definitely do not know why this works but I just used the following to solve the problem:

<select id="selectAll" parameterType="String" resultMap="fastXMLResultMap">
        SELECT CREATIONDATE, DOCUMENTID, TITEL, REGTITEL, INFORCEDATE, DOCTYPE
        FROM ${value}
</select>

I did not set any properties or something else, it was just the change from FROM #{databBaseTable} to FROM ${value}

I someone could answer why this works would be nice. But for now this really helped me.

like image 33
Metalhead89 Avatar answered Sep 23 '22 02:09

Metalhead89