PreparedStatement解决sql注入问题

总结 PreparedStatement解决sql注入问题
：sql中使用？做占位符
2.得到PreparedStatement对象
PreparedStatement pst=conn.prepareStatement(String sql);
pst.setString(1,"aaa");//设置 第一个?的占位符赋值
pst.setString(2,"bbb");

[align=left]// 查找用户 使用PreparedStatement 解决了 sql注入问题[/align]
[align=left] public User findUser(User user) {[/align]
[align=left] String sql = "select * from user where username='?' and password='?'";[/align]
[align=left] Connection conn = null;[/align]
[align=left] PreparedStatement pst = null;[/align]
[align=left] ResultSet rs = null;[/align]
[align=left] try {[/align]
[align=left] conn = jdbcUtils. getConnection();[/align]
[align=left] pst = conn.prepareStatement(sql);[/align]
[align=left] pst.setString(1, user.getUsername());[/align]
[align=left] pst.setString(2, user.getPassword());[/align]
[align=left] rs = pst.executeQuery();[/align]
[align=left] if (rs.next()) {[/align]
[align=left] User u = new User();[/align]
[align=left] u.setId(rs.getInt( "id"));[/align]
[align=left] u.setUsername(rs.getString( "username"));[/align]
[align=left] u.setPassword(rs.getString( "password"));[/align]
[align=left] u.setEmail(rs.getString( "email"));[/align]
[align=left] return u;[/align]
[align=left] }[/align]
[align=left] } catch (Exception e) {[/align]
[align=left] // TODO Auto-generated catch block[/align]
[align=left] e.printStackTrace();[/align]
[align=left] }[/align]
[align=left] return null;[/align]
[align=left] }[/align]