PreparedStatement 和Statement用法区别，加和不加转义字符

PreparedStatement 和Statement用法区别：

String hidden = request.getParameter("action");

if(hidden != null && hidden.trim().equals("post")) {
String userId = request.getParameter("userId") ;
String userName = request.getParameter("userName") ;
String password = request.getParameter("password");
String contactTel = request.getParameter("contactTel") ;
String email = request.getParameter("email");
Connection conn = DB.getConnect();
String sql = "update t_user set user_name = ?, password = ?, contact_tel = ?, email = ? where user_id = ? ";
PreparedStatement preStat = DB.getPreStat(conn, sql);
preStat.setString(1, userName);
preStat.setString(2, password);
preStat.setString(3, contactTel);
preStat.setString(4, email);
preStat.setString(5, userId);
preStat.close();
conn.close();

}

以上是PreparedStatement的用法，如果是Statement的话

String userId = "\"" + request.getParameter("userId") + "\"" ;   //需要转义字符，使得变量传递给sql语句的值带有双引号
String userName ="\"" +  request.getParameter("userName")  + "\"";

String sql = "update t_user set user_name = " + userName + " where user_id =  " + userId ;