--all 用$不能防sql注入 select * from user where name like '%${name}%' --mysql,oracle (db2的concat函數只支持2個參數) select * from user where name like concat('%',#{name},'%') --oracle,db2 select * from user where name like '%'||#{name}||'%' --SQL Server select * from user where name like '%'+#{name}+'%' --聽說這種是預編譯,有空測下 select * from user where name like "%"#{name}"%"