PreparedStatement的应用

package it.cast.jdbc;

import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;

public class SQLInject {

    /**
     * @param args
     * @throws Exception
     * @throws SQLException
     */
    public static void main(String[] args) throws SQLException, Exception {
        read("zero");
    }

    // read
    static void read(String name) throws SQLException, ClassNotFoundException {

        Connection conn = null;
        PreparedStatement ps = null;
        ResultSet rs = null;
        // 2.建立连接
        conn = jdbcUtils.getConnection();

        String sql = "select id,name,birthday,money from user where name =?";

        // 3.创建语句
        ps = conn.prepareStatement(sql);

        ps.setString(1, name);

        // 4.执行语句
        rs = ps.executeQuery();

        // 5.处理结果
        while (rs.next()) {
            System.out.println(rs.getObject(1) + "\t" + rs.getObject(2) + "\t"
                    + rs.getObject(3) + "\t" + rs.getObject(4));
        }

        jdbcUtils.free(rs, ps, conn);
    }

}