PreparedStatement的应用

 package it.cast.jdbc;

 import java.sql.Connection;
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;

 public class SQLInject {

     /**
      * @param args
      * @throws Exception
      * @throws SQLException
      */
     public static void main(String[] args) throws SQLException, Exception {
         read("zero");
     }

     // read
     static void read(String name) throws SQLException, ClassNotFoundException {

         Connection conn = null;
         PreparedStatement ps = null;
         ResultSet rs = null;
         // 2.建立连接
         conn = jdbcUtils.getConnection();

         String sql = "select id,name,birthday,money from user where name =?";

         // 3.创建语句
         ps = conn.prepareStatement(sql);

         ps.setString(1, name);

         // 4.执行语句
         rs = ps.executeQuery();

         // 5.处理结果
         while (rs.next()) {
             System.out.println(rs.getObject(1) + "\t" + rs.getObject(2) + "\t"
                     + rs.getObject(3) + "\t" + rs.getObject(4));
         }

         jdbcUtils.free(rs, ps, conn);
     }

 }

SQLInject