#{} is pre-compiled processing, $ {} is string replacement (used as a placeholder).
When mybatis processes #{}, it replaces #{} in sql with a? sign, and calls the set method of PreparedStatement to assign values;
When mybatis processes ${}, it replaces ${} with the value of the variable.
Using #{} can effectively prevent SQL injection and improve system security. SQL injection occurs during the compilation process, because some special characters are maliciously injected, and they are finally compiled into malicious execution operations. The pre-compilation mechanism can prevent SQL injection very well.