java如何防止sql注入

采用预编译语句集，它内置了处理SQL注入的能力，只要使用它的setString方法传值即可：

String sql= "select * from users where username=? and password=?;

PreparedStatement preState = conn.prepareStatement(sql);

preState.setString(1, userName);

preState.setString(2, password);

ResultSet rs = preState.executeQuery();