防止sql注入

String url = "jdbc:mysql://127.0.0.1:3306/db1?useSSL = false";

String password = "1234";
String uesrname = "root";
Connection conn = DriverManager.getConnection(url, uesrname, password);
//接受用户输入
String name = "zhangsan";
String pwd = "123";
//定义sql
String sql = "select * from tb_user where username = ? and password = ?";

//获取pstatement对象
PreparedStatement pstatement = conn.prepareStatement(sql);
//设置？的值
pstatement.setString(1, name);
pstatement.setString(2, pwd);
//执行sql
ResultSet rs = pstatement.executeQuery();

//判断是否登入成功
if(rs.next()){
    System.out.println("登录成功");
}else{
    System.out.println("登录失败");
}
rs.close();
pstatement.close();
conn.close();