JDBC中PreparedStatement如何防sql攻击

需要用到JUnit测试

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

import org.junit.Test;

public class Demo1 {

	public static void main(String[] args) {
		// TODO Auto-generated method stub

	}

	/**
	 * 登录 使用username和password去查询数据库 若查出结果集，说明正确，返回true 否则返回false 不能放防止sql攻击
	 * 
	 * @param username
	 * @param password
	 * @return
	 * @throws ClassNotFoundException
	 * @throws SQLException
	 */
	public boolean login1(String username, String password) throws ClassNotFoundException, SQLException {

		String driverClassName = "com.mysql.jdbc.Driver";
		String url = "jdbc:mysql://localhost:3306/mydb3";
		String mysqlUsername = "root";
		String mysqlPassword = "050818";
		Class.forName(driverClassName);
		Connection conn = DriverManager.getConnection(url, mysqlUsername, mysqlPassword);
		Statement stmt = conn.createStatement();
		String sql = "select * from t_user where username='" + username + "' and password='" + password + "'";
		System.out.println(sql);
		ResultSet rs = stmt.executeQuery(sql);
		return rs.next();

	}
	
	
	
	@Test
	public void fun1() throws Exception {
		/**
		 * sql攻击
		 */
		String username = "a' or 'a'='a";
		String password = "a' or 'a'='a";
		boolean bool = login1(username, password);
		System.out.println(bool);
	}

	/**
	 * 使用preparedStatement
	 * 
	 * @param username
	 * @param password
	 * @return
	 * @throws ClassNotFoundException
	 * @throws SQLException
	 */

	public boolean login2(String username, String password) throws Exception {

		String driverClassName = "com.mysql.jdbc.Driver";
		String url = "jdbc:mysql://localhost:3306/mydb3";
		String mysqlUsername = "root";
		String mysqlPassword = "050818";
		Class.forName(driverClassName);
		Connection conn = DriverManager.getConnection(url, mysqlUsername, mysqlPassword);

		/**
		 * 一、得到PreparedStatement对象 1.给出sql模板：所有的参数使用?来代替
		 * 2.调用Connection方法，得到PreparedStatement
		 */
		String sql = "select * from t_user where username=? and password=?";
		PreparedStatement pstmt = conn.prepareStatement(sql);

		/**
		 * 二、为参数赋值
		 */
		pstmt.setString(1, username); // 给第一个问号赋值
		pstmt.setString(2, password); // 给第二个问号赋值

		ResultSet rs = pstmt.executeQuery(); // 不需要参数，已经有sql语句了
		return rs.next();
	}


	
	@Test
	public void fun2() throws Exception {
		/**
		 * sql攻击
		 */
		String username = "zhangsan";
		String password = "050818";
//		String username = "a' or 'a'='a";
//		String password = "a' or 'a'='a";
		boolean bool = login2(username, password);
		System.out.println(bool);
	}

}