java防mysql注入

String sql = "SELECT * FROM users WHERE username = ? AND password = ?";
try (PreparedStatement pstmt = connection.prepareStatement(sql)) {
    pstmt.setString(1, username);
    pstmt.setString(2, password);
    ResultSet rs = pstmt.executeQuery();
    // 处理结果集
} catch (SQLException e) {
    e.printStackTrace();
}

Session session = sessionFactory.openSession();
String hql = "FROM User WHERE username = :username AND password = :password";
Query query = session.createQuery(hql);
query.setParameter("username", username);
query.setParameter("password", password);
List<User> users = query.list();
// 处理结果集
session.close();

public boolean isValidUsername(String username) {
    return username != null && username.matches("^[a-zA-Z0-9_]{3,16}$");
}

public boolean isValidPassword(String password) {
    return password != null && password.length() >= 8;
}