Java - 转义字符串以防止SQL注入

import java.sql.Connection;
import java.sql.DriverManager;
import java.sql.PreparedStatement;

public class SQLInjectionExample {
    public static void main(String[] args) {
        String username = "John";
        String password = "Doe";

        try {
            // 加载数据库驱动
            Class.forName("com.mysql.jdbc.Driver");

            // 建立数据库连接
            Connection connection = DriverManager.getConnection("jdbc:mysql://localhost:3306/mydatabase", "username", "password");

            // 创建预编译的SQL语句
            String sql = "SELECT * FROM users WHERE username = ? AND password = ?";
            PreparedStatement preparedStatement = connection.prepareStatement(sql);

            // 设置参数
            preparedStatement.setString(1, username);
            preparedStatement.setString(2, password);

            // 执行查询
            preparedStatement.executeQuery();

            // 关闭连接
            preparedStatement.close();
            connection.close();
        } catch (Exception e) {
            e.printStackTrace();
        }
    }
}