PreparedStatement和Statement的区别

 String sql="select * from user where username = ‘"+"tim"+"‘and  password=‘"+"123‘ OR ‘a‘=‘a"+"‘";
            System.out.println(sql);
            state = conn.createStatement(ResultSet.TYPE_SCROLL_INSENSITIVE, 1007);
            rs = state.executeQuery(sql);
            if (rs.next()) {
                System.out.println("没有解决sql注入问题");
            }else System.out.println("解决了sql注入问题");