Why is #{} preferred over ${} for parameter binding?

#{} is preferred as the default because it compiles down to a JDBC PreparedStatement placeholder, meaning the actual value is sent to the database separately from the SQL statement's structure, which is what fundamentally prevents SQL injection — the database driver treats the bound value purely as data, never as part of the SQL to be parsed and executed.

${}, by contrast, performs plain string substitution before the SQL is even sent to the driver: whatever value is substituted becomes literally part of the SQL text itself, which means a maliciously crafted input value (like appending ' OR '1'='1 to a search parameter) can alter the query's actual logic if that value ever comes from untrusted input.

Beyond the security implication, #{} also gets automatic type handling — MyBatis converts the Java value to the appropriate JDBC type and back — while ${} requires the value to already be a valid literal SQL fragment, meaning correct quoting, escaping, and formatting become the developer's manual responsibility whenever ${} is used, which is one more reason it should be reserved only for the narrow cases (like dynamic identifiers) where a PreparedStatement placeholder genuinely can't be used.