PreparedStatement类防止注入

package org.west.demo2;

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;
import java.sql.SQLException;

//
public class Test {
    public static void main(String[] args) throws ClassNotFoundException, SQLException {
        Class.forName("com.mysql.jdbc.Driver");
        Connection connection = DriverManager.getConnection("jdbc:mysql://localhost:3306/jdbcstudy", "root", "123456");

     String sql="insert into t_user (Sname,pwd) values (?,?)";// ?占位符

        PreparedStatement statement = connection.prepareStatement(sql);


//        statement.setString( 1,"zhaoliu");  //参数1   索引从1开始而不是从0开始计算
//        statement.setString(2,"1234567");   //参数2
//我们不知道向里面添加什么类型可以使用setobject
        //传参
        statement.setObject(1,"dandan");
        statement.setObject(2,"987654");

        int i = statement.executeUpdate();
        System.out.println(i);

    }
}