SQL Injection Prevention in Ibatis

Question

Is there anything built into Ibatis that helps prevent SQL Injection attacks? I'm not looking for a list of ways outside Ibatis to do this, and I'm just wondering if Ibatis has anything to prevent SQL injection.

Answer 1

IBatis uses JDBC-prepared statements under the hood and is therefore safe. However, this only applies if you use the notation # . It is also possible to embed variables directly into your query using the $ notation, which is unsafe (unless you escape them). See this article for more information.

Answer 2

I would suggest that iBatis uses prepared instructions and binds parameters, so it is safe.