准备好的声明没有问号占位符

Question

没有问号占位符的预备声明仍然安全吗？

例:

String username = "userename from EditText";
String password = "password from EditText";

PreparedStatement statement = _con.prepareStatement("SELECT * FROM users WHERE username = '"+username+"' AND password = '"+password+"';");
ResultSet rs = statement.executeQuery();

Answer 1

不,它不安全(针对SQL注入).这与使用相同,Statement并且您没有任何改进.