How does MyBatis prevent SQL injection?

MyBatis itself doesn't actively scan for or block malicious input — its protection comes from encouraging (and defaulting most examples and generated code toward) the #{} parameter binding syntax, which relies on JDBC's own PreparedStatement mechanism to keep SQL structure and data values fully separated.

Because a PreparedStatement placeholder is resolved by the database driver as a bound value rather than parsed as part of the SQL grammar, there's no way for the bound value's content to be interpreted as additional SQL syntax, regardless of what characters it contains — which is the actual mechanism that makes #{}-based queries safe, not any special sanitization logic inside MyBatis itself.

The gap in this protection is entirely on the ${} side: since ${} performs literal string substitution before the SQL is parsed at all, any use of ${} with untrusted input reintroduces the exact injection risk that #{} avoids, which is why secure MyBatis usage in practice comes down to disciplined use of #{} for all actual data values and treating ${} as a narrow, carefully-audited exception rather than a general-purpose binding mechanism.