java拼接sql字符串

在MySQL中应该是如下所写：

SELECT * FROM USER WHERE username='zhangsan' AND PASSWORD='123';

JAVA涉及将用户输入的字符串变量拼接到sql变量中

String sql="select * from user where username='"+user+"'and password ='"+password+"'";

打印输出为：

解释：
"select * from user where username='"是为了拼接SELECT * FROM USER WHERE username='
+user为了拼接zhangsan
+"'and password ='"是为了拼接' and password='
+password为了拼接123
+"'"是为了拼接'