以Mybatis 为例，对常见的SQL 语句场景，构建安全的SQL 语句。

1. 构建一般条件语句

<select id="normalSQL">
  SELECT field_name FROM table_name WHERE 1 = 1
  <if test="condition != null">
    AND field_name = #{condtion}
  </if>
</select>

2. 构建like 条件语句

<select id="likeSQL">
  SELECT field_name FROM table_name WHERE 1 = 1
  <if test="condition != null">
      AND field_name like CONCAT('%', #{condition}, '%')
  </if>
</select>

3. 构建in 条件语句

<select id="inSQL">
  SELECT field_name FROM table_name WHERE 1 = 1
  <if test="conditionArray != null">
    field_name in
      <foreach collection="conditionArray" item="item" open="("close=")" separator=",">
        #{item}
    </foreach>
  </if>
</select>

4 .构建order by 语句

<select id="sortSQL">
  SELECT field_name FROM table_name WHERE 1 = 1
    <if test="sortField != null and sortBy null">
      ORDER BY ${sortField} sortBy}  
    </if>
</select>

由于 MyBatis框架 order by 语句只能拼接，故需要研发人员在代码层控制传入 SQL 语句的参数，禁止将用户输入 据直接传SQL 语句 （参考代码如下：）

// Java 
// 预先 order by 字段字典
Map fieldMap = new HashMap<String, String>();
fieldMap .put("key1", "name");
fieldMap .put("key2", "date");
// 获取用户提交的字典值
String req_sortField = request.getParameter("sortField");
// 预定义默认排序字段
String sortField = "name"；
// 从预定义的字段 典中获取相对应值，若未到则使用默认
boolean result = fieldMap.containsKey(req_sortField);
if(result){
 sortField = fieldMap.get(req_sortField).toString();
}
// 预定义默认排序规则
String sortBy = "asc"；
if(req_sortBy.equals("desc") || req_sortBy.equals("asc"))){
      sortBy = req_sortBy;
}