使用参数化查询/预处理语句

示例代码：

// 原始代码，使用字符串拼接构造SQL查询
String username = request.getParameter("username");
String password = request.getParameter("password");
String sql = "SELECT * FROM users WHERE username='" + username + "' AND password='" + password + "'";
Statement statement = connection.createStatement();
ResultSet resultSet = statement.executeQuery(sql);

// 改良后的代码，使用参数化查询/预处理语句
String username = request.getParameter("username");
String password = request.getParameter("password");
PreparedStatement statement = connection.prepareStatement("SELECT * FROM users WHERE username=? AND password=?");
statement.setString(1, username);
statement.setString(2, password);
ResultSet resultSet = statement.executeQuery();