在servlet中添加进行数据库操作的语句怎么写（写了很多都不能运行）

Question

package Servlet;import java.io.IOException;import java.sql.SQLException;import javax.servlet.ServletException;import javax.servlet.http.HttpServlet;import javax.servlet.http.HttpServletRequest;import javax.servlet.http.HttpServletResponse;import javax.servlet.http.HttpSession;import Dao.loginDao;public class loginServlet extends HttpServlet { public void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { doPost(request, response); } public void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { request.setCharacterEncoding("utf-8"); response.setCharacterEncoding("utf-8"); String method= request.getParameter("method"); if ("login".equals(method)) { login(request, response); } } public void login(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException { String user=request.getParameter("user"); String password=request.getParameter("password"); System.out.println(user); System.out.println(password); loginDao ld = new loginDao(); //boolean login = userDaoImpl.login(userID, passWord); if (1 == 1) { //HttpSession session = request.getSession(); //session.setAttribute("userID", userID); //session.setAttribute("passWord", passWord); request.getRequestDispatcher("index.jsp").forward(request, response); }else { request.getRequestDispatcher("fail.jsp").forward(request, response); }    }   public void find (HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {   HttpSession session = request.getSession();     String userID = (String)session.getAttribute("userID");         }} package Dao;import java.sql.Connection;import java.sql.ResultSet;import java.sql.SQLException;import java.sql.Statement;import Bean.login;import Util.DBUtil;public class loginDao { public static Bean.login login(String user) throws SQLException{             //static Bean.login根据提示修改 String sql = "select * from user where user_name ='" +user+"'"; Connection con = DBUtil.getConnection(); Statement stmd = con.prepareStatement(null); ResultSet rs = stmd.executeQuery(sql); while(rs.next()){ login u = new login();     u.setUser(rs.getString("user"));     u.setPassword(rs.getString("password"));     return null; } return null; }}

Answer 1

你用PreparedStatement对象，你的sql语句怎么还在拼接额。