开发避坑指南(33)：Mybatisplus QueryWrapper 自定义查询语句防注入解决方案

存在注入风险的写法

QueryWrapper queryWrapper = new QueryWrapper();
queryWrapper.inSql("id","select goods_id from t_goods where goods_name like '%"+dto.getGoodsName()+"%'");

正确写法

使用%拼接字符串参数可能造成sql注入风险，需要用占位符的方式进行传参，如下

QueryWrapper queryWrapper = new QueryWrapper();
queryWrapper.apply("id in (select goods_id from t_goods where goods_name like {0})",dto.getGoodsName());