preparedStatement一个小技巧

preparedstatement的sql语句不能用？=？，想要用的话用如下方法

DBconn DB = new DBconn();
Connection con = DB.getConn();
String sql = "SELECT * FROM server,node WHERE server.node_id=node.id GROUP BY hostname;";
String sqlss = "select * from server,node where server.node_id=node.id and %column%=?;";//加百分号是为了让字符串唯一，防止替换了相同的字符串。比如mycolumn

try{

String accord = request.getParameter("accord");
String find = request.getParameter("find");
PreparedStatement pstmt = null;
ResultSet rs = null;

if( accord !=null){

pstmt = con.prepareStatement(sqlss.replace("%column%",accord));

}
Statement stmt = con.createStatement();

System.out.println(accord);
System.out.println(find);

if(find != null){
pstmt.setString(1,find);
rs = pstmt.executeQuery();
System.out.println(sqlss);
}else{
rs = stmt.executeQuery(sql);
}