使用预处理PreparedStatement执行Sql语句

/**
     * 使用预处理的方式执行Sql
     * @param sql Sql语句
     * @param obj 变量值数组
     * @return 查询结果
     * @throws SQLException
     */
    public List<Map<String, Object>> query(String sql, Object[] obj) throws SQLException
    {
        List<Map<String, Object>> ret = null;
        PreparedStatement ps = null;
        ResultSet rs = null;
        try {
            log.debug("start sql="+sql);
            ps = conn.prepareStatement(sql);
            if(obj != null && obj.length > 0){
                for (int i = 0, len = obj.length; i < len; i++) {
                    ps.setObject(i + 1, obj[i]);
                    log.debug("parameterValue: " + obj[i]);
                }
            }
            rs = ps.executeQuery();
            ResultSetMetaData rmd = rs.getMetaData();
            ret = new ArrayList<Map<String,Object>>();
            while (rs.next()) {
                Map<String, Object> rowMap = new LinkedHashMap<String, Object>();
                for (int i = 1, count = rmd.getColumnCount() + 1; i < count; i++) {
                    rowMap.put(rmd.getColumnName(i), rs.getObject(i));
                }
                ret.add(rowMap);
            }
        } catch (SQLException e) {
            log.debug("执行sql语句失败,sql: " + sql + "," + e.getMessage());
            throw e;
        } finally {
            if (rs != null) {
                try {
                    rs.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
            if (ps != null) {
                try {
                    ps.close();
                } catch (SQLException e) {
                    e.printStackTrace();
                }
            }
        }
        return ret;
    }