SQL语句中和字符串的拼接问题

当sql语句和变量进行拼接时，如下：

<a href="/workrecord/insertworkrecord.jsp?name=<%=name%>">添加工作记录</a>

当多个变量作为参数进行拼接时，如下：

<a href="goodsAction.do?action=13&big=<%=session.getAttribute("big")%>&small=<%=smallForm.getId()%>&id=<%=smallForm.getBigId()%>"><%=smallForm.getSmallName()%></a>

 

如果是sql拼接，则用：String sql="select * from yonghu where username='"+username+"'";

"select count(*) from user where uid =  ' "+uid+" ' "