JDBC_PreparedStatement 防sql注入

package songyan.jdbc.login.prepared;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.Statement;
import java.util.ArrayList;
import java.util.List;

import songyan.jdbc.entity.User;
import songyan.jdbc.util.Util;

public class prepareTest {
public static void main(String[] args) throws Exception
{
    Connection conn=null;
    PreparedStatement sta =null;
    ResultSet rs=null;

    String url="jdbc:mysql://localhost:3306/day06";
    String driverClass="com.mysql.jdbc.Driver";
    String username="root";
    String password="247418";
    String sql="select * from users where name=? and password= ?";

    Class.forName(driverClass);
    conn=DriverManager.getConnection(url,username,password);
    sta=conn.prepareStatement(sql);
    sta.setString(1, "bbb");
    sta.setString(2, "aaa");
    rs=sta.executeQuery();

    List<User> l= new ArrayList<User>();
    while(rs.next())
    {
        User u= new User();
        u.setId(rs.getInt(1));
        u.setName(rs.getString(2));
        u.setPassword(rs.getString(3));
        u.setEmail(rs.getString(4));
        u.setBirthday(rs.getDate(5));
        l.add(u);
    }
    for(User u :l)
    {
        System.out.println(u.getId()+"  "+u.getName());
    }
    Util.closeAll(conn, sta, rs);

}
}