JDBC statement与preparedStatement

1、 Statement

   

StringBuffer SQL = new StringBuffer("select * from user where ");String sign = "";if(user.getID() > 0){SQL.append("ID = '" + user.getID()+"'");sign = " and ";}if(user.getName() != null){SQL.append(sign+"name = '" + user.getName()+"'");}rs = stat.executeQuery(SQL.toString());

2、PreparedStatement        

User u = new User();String sql = "select * from user where ID = ? or name = ?";PreparedStatement ps = con.prepareStatement(sql);ps.setLong(1, user.getID());ps.setString(2, user.getName());ps.execute();rs = ps.getResultSet();