JSP本页查询显示，以及如何拼接SQL语句

下面写一下关于获得本页面输入框用户输入的参数，然后在本页面显示信息的方法。

<form action="ShowData.jsp">
<input name="key" type="text" id="key" value="要查询的物质" size="30"  align="center"
onmouseover=this.focus();this.select();
onclick="if(value==defaultValue){value='';this.style.color='#000'}"
onBlur="if(!value){value=defaultValue;this.style.color='#999'}" style="color:#999" />

<input type="submit" value="点击查看" />
</div>
</form>

java代码获取用户输入：

String people_input = request.getParameter("key");
StringBuffer sd_name = new StringBuffer();
StringBuffer sd_value = new StringBuffer();
DBUtils dbUtils = new DBUtils();
String sql = "select dairy.DairyID,dairy.SimpleName,"+people_input+" from Dairy  where DairyID>3534 and DairyID<3626 ORDER BY  '"+people_input+"'  DESC limit 0,10";
System.out.println(sql+"++++++++++");
ResultSet rs = dbUtils.select(sql);
while(rs.next()){
sd_name.append(rs.getString(2)+",");
sd_value.append(rs.getString(3)+",");
}
System.out.println(sd_name);
System.out.println(sd_value);

主要要是如何拼凑SQL语句。"+people_input+"然后是学会打印SQL语句，把打印出来的SQL语句运行看能不能查询出来。