Java防SQL注入MySQL数据查询

/**
 *
 */
package user.DAO;

import java.sql.*;

import user.entity.User;

/** *//**
 * 用户数据访问层
 * @author http://www.my400800.cn
 *@version 1.0
 *日期2010 01 12
 */
public class UserDAO {
    /** *//**
     * 根据用户名和密码查找用户,找到了返回 user 对象,否则返回 null
     * @param(参量) user
     */
    public findUserByUsernamePassword(User user){
        // 1.注册驱动
        try {
            Class.forName("com.mysql.jdbc.Driver");
        } catch (ClassNotFoundException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }//mysql驱动
       
        java.sql.Connection conn = null;
        PreparedStatement pstmt = null;   
        ResultSet rs = null;
       
        try {
            //2.获取数据库的连接(接数据库)
            conn = java.sql.DriverManager.getConnection(
                    "jdbc:mysql://localhost/stums?useUnicode=true&characterEncoding=GBK","root","admin");
           
            //执行SQL
            pstmt = conn.prepareStatement("select * from student where Sno =? and Password = ?");
           
             //设置参数防止SQL注入
            pstmt.setString(1, user.getUsername());
            pstmt.setString(2, user.getPassword());
           
            //获取数据集
            rs = pstmt.executeQuery();
           
            if(rs != null && rs.next()){
                user.setId(rs.getInt("Sno"));
                return user;
            }
           
        } catch (SQLException e) {
            // TODO Auto-generated catch block
            e.printStackTrace();
        }finally{    //释放资源
            try {
                rs.close();     //关闭数据集
            } catch (Exception e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
            try {
                pstmt.close();    //关闭表连接
            } catch (Exception e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
            try {
                conn.close();    //关闭数据库连接
            } catch (Exception e) {
                // TODO Auto-generated catch block
                e.printStackTrace();
            }
        }
       
        return null;
       
       
    }

}