使用 PreparedStatement 进行模糊查询

select * from tblcategory,tblproduce
where tblcategory.category = tblproduce.category and name like ‘%?%’

这样的问题网上也有很多人问。PreparedStatement的用法和直接的SQL语句是不同的，正确的方法应当是这样写，例如：

String sql = “select * from App_User Where UserName Like ?”;
String UserName = “mxh1”;
PreparedStatement cmd = cn.prepareStatement(sql);
cmd.setString(1,"%" + UserName + “%”);
ResultSet rs = cmd.executeQuery();
while(rs.next())
{
out.print("

• UserName = " + rs.getString(“UserName”));
  }

• 注意：cmd.setString(1,"%" + UserName + “%”);