Setting FROM clause via parameter in MyBatis

Question

I could not see anything in the documentation that says my question, and when it is deployed, my application does not work correctly (more about this in a second). I'm trying to do something like

<select id="getLookupRows" parameterType="map" resultMap="lookupMap"> select id, name, active, valid from #{table} </select> 

in MyBatis. I have several lookup tables that have common columns, and so the user at the presentation level determines which lookup table is ultimately used. The error that I get when trying to execute getLookupRows is

 Cause: org.apache.ibatis.executor.ExecutorException: There was no TypeHandler found for parameter table of statement info.pureshasta.mapper.LookupMapper.getLookupRows org.apache.ibatis.exceptions.ExceptionFactory.wrapException(ExceptionFactory.java:8) org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:77) org.apache.ibatis.session.defaults.DefaultSqlSession.selectList(DefaultSqlSession.java:69) org.apache.ibatis.binding.MapperMethod.executeForList(MapperMethod.java:85) org.apache.ibatis.binding.MapperMethod.execute(MapperMethod.java:65) org.apache.ibatis.binding.MapperProxy.invoke(MapperProxy.java:38) $Proxy15.getLookupRows(Unknown Source) info.pureshasta.service.FieldTitleService.getLookupRows(FieldTitleService.java:33) 

My map interface is as follows:

 List<Lookup> getLookupRows(@Param("specificColumn") String specificColumn, @Param("table") String table); 

so we know that I'm trying to pass String to this request, nothing special. I have a specific column because this will be my next task. In fact, one of the columns of each of the lookup tables is unique, so I need to call the corresponding specificColumn, but I would be very happy if I could use the table parameter and the FROM clause.

Answer 1

 <select id="getLookupRows" parameterType="map" resultMap="lookupMap"> select id, name, active, valid from ${table} </select> 

does the trick. There is another designation from the actual input to the value for the column and table name, and then the column value. If you insert a value in the where clause, then the # notation is used correctly.

If the value used for the table in this query is not escaped, problems with SQL injection may occur. For my use case, the DB preceded me, and although I can do whatever I want for the Java and View parts, I am not allowed to change the fundamental structures of the tables.

If someone wants to further explain the stack trace I received (for example, what type of table myBatis was thinking), I would like to read and be more educated.