JDBC中PreparedStatement如何防sql攻击

需要用到JUnit测试import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.sql.Statement;

import org.junit.Test;

public class Demo1 {

public static void main(String[] args) {
// TODO Auto-generated method stub

}

/**
* 登录 使用username和password去查询数据库 若查出结果集，说明正确，返回true 否则返回false 不能放防止sql攻击
*
* @param username
* @param password
* @return
* @throws ClassNotFoundException
* @throws SQLException
*/
public boolean login1(String username, String password) throws ClassNotFoundException, SQLException {

String driverClassName = "com.mysql.jdbc.Driver";
String url = "jdbc:mysql://localhost:3306/mydb3";
String mysqlUsername = "root";
String mysqlPassword = "050818";
Class.forName(driverClassName);
Connection conn = DriverManager.getConnection(url, mysqlUsername, mysqlPassword);
Statement stmt = conn.createStatement();
String sql = "select * from t_user where username='" + username + "' and password='" + password + "'";
System.out.println(sql);
ResultSet rs = stmt.executeQuery(sql);
return rs.next();

}

@Test
public void fun1() throws Exception {
/**
* sql攻击
*/
String username = "a' or 'a'='a";
String password = "a' or 'a'='a";
boolean bool = login1(username, password);
System.out.println(bool);
}

/**
* 使用preparedStatement
*
* @param username
* @param password
* @return
* @throws ClassNotFoundException
* @throws SQLException
*/

public boolean login2(String username, String password) throws Exception {

String driverClassName = "com.mysql.jdbc.Driver";
String url = "jdbc:mysql://localhost:3306/mydb3";
String mysqlUsername = "root";
String mysqlPassword = "050818";
Class.forName(driverClassName);
Connection conn = DriverManager.getConnection(url, mysqlUsername, mysqlPassword);

/**
* 一、得到PreparedStatement对象 1.给出sql模板：所有的参数使用?来代替
* 2.调用Connection方法，得到PreparedStatement
*/
String sql = "select * from t_user where username=? and password=?";
PreparedStatement pstmt = conn.prepareStatement(sql);

/**
* 二、为参数赋值
*/
pstmt.setString(1, username); // 给第一个问号赋值
pstmt.setString(2, password); // 给第二个问号赋值

ResultSet rs = pstmt.executeQuery(); // 不需要参数，已经有sql语句了
return rs.next();
}

@Test
public void fun2() throws Exception {
/**
* sql攻击
*/
String username = "zhangsan";
String password = "050818";
// String username = "a' or 'a'='a";
// String password = "a' or 'a'='a";
boolean bool = login2(username, password);
System.out.println(bool);
}

}