Java如何防sql注入

采用预编译语句集，它内置了处理SQL注入的能力，只要使用它的setString方法传值即可：
          String sql= "select * from users where username=? and password=?;
          PreparedStatement preState = conn.prepareStatement(sql);
          preState.setString(1, userName);
          preState.setString(2, password);
          ResultSet rs = preState.executeQuery();