多条件查询Dao和Servlet

Dao

public List<Borrow> queryBorrowByBookNameAndStudentNameAndClassName(String bookName, String studentName,
			String clsName) {
   
		List<Borrow> list = new ArrayList<Borrow>();
		String sql = "select id,name,borrowDate,sid from tbl_borrow where 1=1 ";
		if (bookName != null && !"".equals(bookName)) {
   
			sql = sql + " and name='" + bookName + "'";
		}

		if (studentName != null && !"".equals(studentName)) {
   
			sql = sql + " and sid in(select id from tbl_student where name='" + studentName + "')";
		}

		if (clsName != null && !"".equals(clsName)) {
   
			sql = sql + " and sid in(select id from tbl_student where cls='" + clsName + "')";
		}

		Connection con = null;
		Statement st = null;
		ResultSet rs = null;
		try {
   
			con