防止sql注入等的危险

@Test
public void testLogin2() throws Exception {
Connection con = ConnUtils.getCon();

Scanner sc = new Scanner(System.in);
String name = sc.nextLine();
String pwd = sc.nextLine();
//使用？占位符，不能用串联字符串
String sql ="select * from users where name=? and pwd=?";
//执行sql语句使用

PreparedStatement pst = con.prepareStatement(sql);
pst.setString(1, name);
pst.setString(2, pwd);
System.err.println(sql);
ResultSet rs = pst.executeQuery();
if(rs.next()){
System.err.println("登录成功");
}else{
System.err.println("用户名或是密码错误..");
}

pst.close();
con.close();
}