数据库防注入攻击

package sc.itcsat.demo;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.Scanner;

import javax.naming.spi.DirStateFactory.Result;

import com.mysql.jdbc.PreparedStatement;
import com.mysql.jdbc.Statement;

public class JDBC_Demo2 {

	/**
	 * @param args
	 * @throws ClassNotFoundException 
	 * @throws SQLException 
	 * @throws Exception 
	 */
	public static void main(String[] args) throws ClassNotFoundException, SQLException   {
		Class.forName("com.mysql.jdbc.Driver");
		String url = "jdbc:mysql://localhost:3306/firstmysql";
		String username = "root";
		String password = "root";
		Connection con = DriverManager.getConnection(url, username, password);		
		//Statement stat = (Statement) con.createStatement();
		
		Scanner sc=  new Scanner(System.in);
		String user =sc.nextLine();
		String pass = sc.nextLine();  
		String sql = "SELECT * FROM users WHERE uname=? AND upassword=?";
		PreparedStatement pst = (PreparedStatement)  con.prepareStatement(sql);
		
	    pst.setObject(1,user);
		pst.setObject(2, pass);
		ResultSet rs = pst.executeQuery();
		while(rs.next()) {
			System.out.println(rs.getString("uname") + " " + rs.getString("upassword"));
		}
		
		rs.close();
		pst.close();
		con.close();
	} 

}