关于SQL语句和变量的组合问题

String user = "admin";
Query q = session.createQuery("from Users u where u.username='" + user + "'");

Query q = session.createQuery("from Users u where u.username=?");
q.setParameter(0, "admin");

String sql = "select * from books where user = ?";
PreparedStatement stm;
try {
stm = conn.prepareStatement(sql);

stm.setString(1, user); ">//占位符是从1开始的
ResultSet rs = stm.executeQuery();
while(rs.next()){
Book book = new Book();
book.setBookName(rs.getString("bookname"));
book.setUser(rs.getString("user"));
books.add(book);
}
} catch (SQLException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}