javaWeb中字符串拼接

javaWeb中字符串拼接

        string name = "哈哈";
        String id = "' or '1' = '1";

        //3.定义sql
        String sql = "select * from stu where id = '"+id+"' and name = '"+name+"'";

• 这里的 "++" 将会被代替