title: Safe way to prevent sql injection with mybatis
body: <p>I am using '$' notation in mybatis query:</p>
  
  <pre><code>&lt;select id="queryOrgs" resultMap="orgLiteMap" parameterType="gov.cbrc.gzbanking.data.QueryRequest" &gt;
          select id, name from sys_orgs
          &lt;if test="filter != null"&gt;where id like #{filter, jdbcType=INTEGER} or name like #{filter, jdbcType=INTEGER}&lt;/if&gt;
          &lt;if test="order != null"&gt;order by ${order}&lt;/if&gt;
          limit #{offset, jdbcType=INTEGER},#{fetch, jdbcType=INTEGER}
       &lt;/select&gt;
  </code></pre>
  
  <p>the order parameter can be something like "id desc", do I need to worry about sql injection here? We know that mybatis uses <code>PreparedStatement</code>, if mybatis call <code>PreparedStatement#executeQuery()</code> against "select" statement, or the jdbc driver implementation does't allow multiple statements in one call, then sql injection is impossible, am I right? </p>
  
  <p>If that is possible for sql injection in my case, what's the verified way to prevent it ?</p>
  
  <p>------------------------ <strong>edit</strong> -----------------------</p>
  
  <p>Is that enough to check <code>order</code> parameter has a sql delimiter?</p>