利用拼接字符串可能导致SQL注入问题

package info.dyndns.oszc.Introduce;

import java.sql.Connection;
import java.sql.ResultSet;
import java.sql.Statement;

public class SQLInject {

	public static void read(String name) throws Exception{
		String url =  "jdbc:mysql://localhost:3306/comment";
		String sql = "select id,name,content from say WHERE name =""+name+""";
		System.out.println( sql);
		Connection conn =
				JdbcUtils.conn(url, "oszc", "1234");
		Statement st = conn.createStatement();
		ResultSet rs = st.executeQuery(sql);
		while (rs.next()){
			System.out.println(rs.getObject("id")+"	"+
		rs.getObject("name")+"	"+rs.getObject("content")+"	");
		}
		
		JdbcUtils.closeDB(rs, st, conn);
	}
	/**
	 * @param args
	 * @throws Exception 
	 */
	public static void main(String[] args) throws Exception {
		read("" or 1 or"");
	}

}

select id,name,content from say WHERE name ="" or 1 or""
110 CX (58.39.53.166  2012-1-26 22:12:59)我要钱~我要钱~我要钱......
119 zc (61.165.226.251  2012-1-26 22:34:11)保佑中500W!!!
120 stefanie (218.73.128.118  2012-1-26 22:41:46)今年记得罩着我
121 杨磊磊 (114.89.212.184  2012-1-26 23:01:17)欢迎光临！
124 xxx 正确了！
125 xxx 正确了！
126 xxx 呵呵

看到字符串被拼为永远是true的状态，1代表true，输出结果验证了拼串可以一次输出全部数据，解决方法待续