title: MyBatis protect String Substitution parameter from sql injection
body: <p>I need to protect (automatically) requests using String substitution in MyBatis <code>${myValue)</code>.</p>
  
  <p>From what I've seen, the substitution is done automatically in the <code>GenericTokenParser</code> class using the <code>TokenHandler.handleToken</code> method.</p>
  
  <p>I can't find anything about getting a grab on those values.
  I can access PreparedStatement parameters using </p>
  
  <pre><code>sqlSession.getConfiguration().getMappedStatement(statement).getBoundSql(parameter).getParameterMappings()
  </code></pre>
  
  <p>But I really need to retrieve <code>${}</code> parameters before sending the request to be able to modify the value if needed to protect from SQL Injection.</p>
  
  <p>I though about using AspectJ to intercept the <code>TokenHandler.handleToken</code> method. But I would really prefer to be able to inject my own handler or token parser.</p>
  
  <p>Has someone a clue ?</p>
  
  <hr>
  
  <p>I'm working on a "framework" for future development, the aim is to have something automatic. Going through the whole parameter object isn't an option (could be heavy), we only want to protect those used in the request before executing it.</p>