Mybatis Patterns

MyBatis Patterns

Use MyBatis when SQL control and explicit mappings matter. Keep SQL readable, make mapper contracts small, and put business transactions in the service layer. Pair this skill with springboot-patterns for application structure, database-migrations for schema changes, postgres-patterns or mysql-patterns for engine-specific SQL, and security-review for untrusted input and access-control concerns.

When to Activate

• Adding or reviewing MyBatis mapper interfaces or XML files
• Choosing between XML mappers, annotation mappers, and generated SQL
• Designing resultMap mappings, joins, nested collections, or projections
• Reviewing dynamic SQL, parameter binding, pagination, or batch writes
• Debugging N+1 queries, slow statements, connection use, or transaction bugs
• Integrating MyBatis-Spring into Spring Boot or an XML-first legacy application

How It Works

Use a thin mapper for persistence operations and keep business rules in a service. A typical flow is:

Controller / batch job -> Service (@Transactional) -> Mapper -> Database

• Register mappers once, either with @Mapper on each interface or with @MapperScan for a package. Do not mix registration approaches casually.
• Keep the XML namespace equal to the mapper interface's fully qualified name.
• Give each statement a stable, descriptive id; treat mapper methods as a persistence API that can be tested independently.
• Return a domain DTO or projection for read paths instead of exposing a large mutable map when the shape is known.
• Keep schema changes in migrations. Do not make mapper startup silently create or alter production tables.

Examples

@MapperScan("com.example.user.persistence")
@Configuration
class MyBatisConfig {
}

public interface UserMapper {
  UserSummary findSummaryById(long userId);
}

<mapper namespace="com.example.user.persistence.UserMapper">
  <select id="findSummaryById"
          parameterType="long"
          resultType="com.example.user.persistence.UserSummary">
    SELECT id, display_name AS displayName, status
    FROM users
    WHERE id = #{userId}
  </select>
</mapper>

Parameter Binding and SQL Safety

Use #{...} for values. MyBatis binds it as a prepared-statement parameter. Treat ${...} as raw SQL text: it is only appropriate for a value selected from a closed, application-owned allowlist such as a sort-column map.

private static final Map<String, String> SORT_COLUMNS = createSortColumns();

private static Map<String, String> createSortColumns() {
    Map<String, String> columns = new HashMap<>();
    columns.put("name", "display_name");
    columns.put("created", "created_at");
    return Collections.unmodifiableMap(columns);
}

String sortColumn = SORT_COLUMNS.getOrDefault(request.sort(), "created_at");
String sortDirection = request.descending() ? "DESC" : "ASC";
// The mapper receives only an allowlisted identifier; user input is never
// passed directly to ${sortColumn} or ${sortDirection}.

<select id="findPage" resultType="com.example.user.persistence.UserSummary">
  SELECT id AS id,
         display_name AS displayName,
         status AS status,
         created_at AS createdAt
  FROM users
  WHERE tenant_id = #{tenantId}
  ORDER BY ${sortColumn} ${sortDirection}
  LIMIT #{limit}
</select>

Derive tenantId from the authenticated principal or a server-side tenant context, never from a request field. Authenticate the principal and verify that it is authorized for the tenant before invoking the mapper; keep the tenant_id predicate in SQL as defense in depth.

If possible, avoid ${} entirely by selecting among fixed statements or by using a database-specific query builder. Never interpolate user input into a table name, column name, ORDER BY, WHERE fragment, or SQL expression.

For multiple parameters, use a request object or explicit @Param names:

List<UserSummary> findActive(
    @Param("tenantId") long tenantId,
    @Param("statuses") Set<UserStatus> statuses
);

Do not use the deprecated external parameterMap element. Prefer inline parameter mappings and explicit jdbcType for nullable values when the JDBC driver needs it.

XML, Result Types, and Result Maps

• Use resultType for a simple one-to-one mapping whose column labels already match the target properties.
• Use resultMap when aliases, type handlers, nested objects, or collections need explicit mapping.
• Mark the identity column with <id> in a complex result map. It helps MyBatis deduplicate nested results and documents the row identity.
• Prefer explicit column lists and aliases over relying on global automapping.
• Keep nested collections bounded. A multi-join can multiply rows and memory use; for large child collections, fetch the parent page first and load children in a bounded second query.
• Treat nested select mappings as a possible N+1 query. Use a join, a batch query, or an intentional prefetch when the access pattern requires it.

<resultMap id="orderResultMap" type="com.example.order.OrderView">
  <id property="id" column="order_id" />
  <result property="status" column="order_status" />
  <association property="customer" javaType="com.example.customer.CustomerView">
    <id property="id" column="customer_id" />
    <result property="name" column="customer_name" />
  </association>
</resultMap>

Use a type handler for deliberate conversions such as enums, JSON, or vendor types. Test the handler with NULL, invalid values, and both read and write paths; do not hide conversion failures by returning a silent default.

Dynamic SQL

Use MyBatis tags to keep optional predicates syntactically correct:

<select id="search" resultType="com.example.user.UserSummary">
  SELECT id, display_name AS displayName, status
  FROM users
  <where>
    tenant_id = #{tenantId}
    <if test="status != null">
      AND status = #{status}
    </if>
    <if test="query != null and query != ''">
      AND display_name LIKE #{queryPattern}
    </if>
    <if test="ids != null and ids.size() > 0">
      AND id IN
      <foreach collection="ids" item="id" open="(" separator="," close=")">
        #{id}
      </foreach>
    </if>
  </where>
  ORDER BY created_at DESC, id DESC
</select>

Build queryPattern at the service boundary and define whether % and _ are user-controlled wildcards or escaped literal characters. Keep that choice out of the XML and use the database's documented escape syntax when literals are required.

If ids is an optional filter, choose its empty-list behavior at the service boundary before invoking the mapper. This example treats an explicitly empty list as "no matches"; an application that treats it as "no ID filter" must normalize it to null deliberately instead:

public List<UserSummary> search(UserSearchRequest request) {
  if (request.ids() != null && request.ids().isEmpty()) {
    return Collections.emptyList();
  }
  UserSearchRequest prepared = request.query() == null
      ? request
      : request.withQueryPattern(buildLikePattern(request.query()));
  return userMapper.search(prepared);
}

Here withQueryPattern returns a copy of the request, and buildLikePattern adds the intended wildcards while escaping literal % and _ according to the database dialect. Do not pass raw search text as queryPattern.

The mapper retains the ids.size() > 0 guard as defense in depth. That guard omits the entire ID predicate for an empty list, which broadens the query. The service must short-circuit empty lists before calling the mapper, and any caller that bypasses the service must reject empty IDs before query execution. Reserve null for the deliberate "no ID filter" case.

• Prefer <where>, <set>, <trim>, <choose>, and <foreach> to manual string concatenation.
• Define the empty-list behavior in the service. Return no rows, skip the query, or apply an explicit false predicate; never let an empty list silently remove the ID predicate or rely on IN () behavior.
• Keep the allowed shape of dynamic SQL small. If a query has many branches, split it into named statements or move carefully selected alternatives into separate mapper methods.
• Use a single SQL fragment with <sql> and <include> only for stable, readable fragments. Do not build a second templating language inside XML.

Transactions and Sessions

Put transaction boundaries around use cases in the service layer. A service method that updates several tables should call multiple mappers inside one Spring transaction so the changes commit or roll back together.

@Service
public class UserService {
  private final UserMapper userMapper;
  private final AuditMapper auditMapper;
  private final SecurityContext securityContext;
  private final AuthorizationService authorization;

  public UserService(
      UserMapper userMapper,
      AuditMapper auditMapper,
      SecurityContext securityContext,
      AuthorizationService authorization) {
    this.userMapper = userMapper;
    this.auditMapper = auditMapper;
    this.securityContext = securityContext;
    this.authorization = authorization;
  }

  @Transactional
  public void deactivate(long userId) {
    AuthenticatedPrincipal actor = securityContext.requireAuthenticatedPrincipal();
    authorization.requireCanDeactivate(actor, userId);

    int updated = userMapper.deactivate(userId);
    if (updated != 1) {
      throw new IllegalStateException("User was not updated");
    }
    auditMapper.recordDeactivation(userId, actor.id());
  }
}

Never accept actorId from request data. For an authorized batch job, create an explicit trusted system principal server-side and pass that principal through the same authorization and audit path; do not use a caller-supplied identity.

MyBatis-Spring coordinates a Spring-managed SqlSession with the configured transaction manager. Do not call commit(), rollback(), or close() on an injected mapper or Spring-managed SqlSession. Avoid injecting a raw DefaultSqlSession; it is not thread-safe and bypasses Spring resource management. If direct session access is unavoidable, document ownership, closing, and transaction behavior in the same code review.

For read paths, @Transactional(readOnly = true) can communicate intent and allow a compatible transaction manager or driver to optimize, but it is not a substitute for a correct query plan. Keep transactions short and never hold a database transaction across a remote API call.

Pagination and Large Reads

• Use a stable order. Add a unique tie-breaker such as id to the sort.
• Use keyset pagination for deep or high-volume pages when the database and product UX allow it:

SELECT id, display_name, created_at
FROM users
WHERE tenant_id = #{tenantId}
  AND (created_at, id) < (#{lastCreatedAt}, #{lastId})
ORDER BY created_at DESC, id DESC
LIMIT #{limit}

• Use offset pagination only when its bounded cost is acceptable. Verify the generated SQL and query plan; do not assume RowBounds pushes pagination to the database.
• Cap page size at the service or API boundary and apply a server-side default.
• For exports, prefer a cursor or bounded chunks with a driver-appropriate fetchSize. Do not load an unbounded result set into a List.
• If a total count is needed, measure it separately. A COUNT(*) over the same complex join can be more expensive than the page query and may need a simplified count statement.