MyBatis 3.5

Apply the Java 21 prompt first. These rules target MyBatis 3.5 (org.mybatis:mybatis) on Java 21 and were checked against 3.5.19; MyBatis core has a Java 8 minimum. Review separately versioned integrations, generators, and scripting libraries against their own documentation.

SQL and expression boundaries

• Bind values with #{...} in XML, annotation SQL, and provider output; retain the default statementType="PREPARED" for ordinary statements. Preparing SQL does not make earlier string concatenation safe.
• Treat ${...} inside SQL as unescaped text. Replace value substitutions with bindings; select identifiers, ordering, and other SQL structure through fixed mapper branches or mappings to developer-owned fragments. Configuration-property substitution is a separate boundary and must also use trusted inputs.
• Keep SQL returned by @SelectProvider, @InsertProvider, @UpdateProvider, and @DeleteProvider under application control. Never bind a request directly to an object that supplies an entire SQL statement, including when integrating MyBatis Dynamic SQL.
• Pass only trusted SQL templates to org.apache.ibatis.jdbc.SQL methods such as WHERE, SET, ORDER_BY, and LIMIT(String); the builder assembles SQL and does not sanitize these strings. Put #{...} placeholders in value positions.
• Keep OGNL expressions in <if test>, <when test>, <foreach collection>, and <bind value> developer-authored. Supply untrusted input only as data, and reference a computed <bind> value through #{...} instead of interpolating it into SQL or another expression.