JDBC statement与preparedStatement

StringBuffer SQL = new StringBuffer("select * from user where ");
String sign = "";
if(user.getID() > 0){
SQL.append("ID = '" + user.getID()+"'");
sign = " and ";
}
if(user.getName() != null){
SQL.append(sign+"name = '" + user.getName()+"'");
}
rs = stat.executeQuery(SQL.toString());

User u = new User();
String sql = "select * from user where ID = ? or name = ?";
PreparedStatement ps = con.prepareStatement(sql);
ps.setLong(1, user.getID());
ps.setString(2, user.getName());
ps.execute();
rs = ps.getResultSet();