String sql="SELECT user,password FROM user_table WHERE user= '"+user+"' AND password='"+password+"'"; 拼的串拿双引号包起来之后再用单引号包起来