PerparedStatement的使用，及模糊查询时候的参数注入

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;

public class PreparStatementTest2 {

	public static void main(String[] args) {
		// TODO Auto-generated method stub
		// TODO Auto-generated method stub
		String url = "jdbc:mysql://localhost:3306/mysqletc";
		String user = "root";
		String password = "123456";
		// 加载驱动
		try {
			Class.forName("com.mysql.jdbc.Driver");
			// 得到连接
			Connection conn = DriverManager.getConnection(url, user, password);
			// 创建PerparedStatement
			//String sql = "select * from commodity where name like '%?%'";
			String search = "米";
			String sql = "select * from commodity where name like ?";
			PreparedStatement ps = conn.prepareStatement(sql);
			search = "%"+search+"%";
			ps.setString(1, search);
			ResultSet rs = ps.executeQuery();
			while(rs.next()){
				System.out.println(rs.getInt("id")+rs.getString("name"));
			}
		} catch (ClassNotFoundException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		} catch (SQLException e) {
			// TODO Auto-generated catch block
			e.printStackTrace();
		} finally{
			
		}
	}

}