sql注入的解决方法（注 代码）

package com.hkd.test;

import java.sql.Connection;

import java.sql.DriverManager;

import java.sql.ResultSet;

import java.sql.SQLException;

import java.util.Scanner;

import com.mysql.jdbc.PreparedStatement;

public class test2 {

public static void main(String[] args) {
Scanner scan =new Scanner(System.in);
System.out.println("请输入用户名：");
String name =scan.next();
try {
Class.forName("com.microsoft.sqlserver.jdbc.SQLServerDriver");
} catch (ClassNotFoundException e) {
// TODO Auto-generated catch block
System.out.println("创建失败");
e.printStackTrace();
}
try {
Connection conn =DriverManager.getConnection("jdbc:sqlserver://localhost:1433;DataBaseName=school", "sa", "m123");
java.sql.Statement sta =conn.createStatement();
String sql ="select * from school where name like ?";
java.sql.PreparedStatement ps =conn.prepareStatement(sql);
ps.setString(1,"%"+ name+"%");
ResultSet rs =ps.executeQuery();
while(rs.next()){
System.out.println(rs.getInt("studentno"));
System.out.println(rs.getString("name"));
System.out.println(rs.getInt("age"));
System.out.println(rs.getInt("tel"));
}
rs.close();
ps.close();
sta.close();
conn.close();
} catch (SQLException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
}

}