PreparedStatement的应用

 package it.cast.jdbc;
 
 import java.sql.Connection;
 import java.sql.PreparedStatement;
 import java.sql.ResultSet;
 import java.sql.SQLException;
 
 public class SQLInject {
 
     /**
      * @param args
      * @throws Exception
      * @throws SQLException
      */
     public static void main(String[] args) throws SQLException, Exception {
         read("zero");
     }
 
     // read
     static void read(String name) throws SQLException, ClassNotFoundException {
 
         Connection conn = null;
         PreparedStatement ps = null;
         ResultSet rs = null;
         // 2.建立连接
         conn = jdbcUtils.getConnection();
 
         String sql = "select id,name,birthday,money from user where name =?";
 
         // 3.创建语句
         ps = conn.prepareStatement(sql);
 
         ps.setString(1, name);
 
         // 4.执行语句
         rs = ps.executeQuery();
 
         // 5.处理结果
         while (rs.next()) {
             System.out.println(rs.getObject(1) + "\t" + rs.getObject(2) + "\t"
                     + rs.getObject(3) + "\t" + rs.getObject(4));
         }
 
         jdbcUtils.free(rs, ps, conn);
     }
 
 }

SQLInject