防止sql注入的查询方法，接口的实现不太会写，求指教

接口：public List> query(String sql, Object[] parameters)
throws Exception;

实现：

public List> query(String sql, Object[] parameters)
throws Exception {
List userList = new ArrayList();
Connection conn = DBUtil.getConnect();
PreparedStatement pstmt;
ResultSet rs;
pstmt = (PreparedStatement) conn.prepareStatement(sql);
for (int i = 1; i < parameters.length; i++) {
pstmt.setObject(i, parameters[i]);// 填充sql 语句
}
// 获取结果集
rs = pstmt.executeQuery();

    // 之后将获取的每一条记录封装到一个类中

    //while里面不会写了
    while (rs.next()) {

        Object[] o = {user.getUsername(),user.getPassword()};

        for (int i = 0; i < parameters.length; i++) {
            pstmt.setObject(i, parameters[i]);// 填充sql 语句
        }
        userList = Arrays.asList(o);
    }
    return userList;

}

res = pst.executeQuery();
while (res.next()) {
User u = new User();
u.setSid(res.getString("sid"));
u.setCourseid(res.getString("courseid"));
u.setGrade(res.getString("grade"));
array.add(u);
}

        上面是加入list的代码，下面是补充User的代码
        package com.jdbc;

public class User implements java.io.Serializable{
/**
*
*/
private static final long serialVersionUID = 1L;
private String sid;
private String courseid;
private String grade;
public String getSid() {
return sid;
}
public void setSid(String sid) {
this.sid = sid;
}
public String getCourseid() {
return courseid;
}
public void setCourseid(String courseid) {
this.courseid = courseid;
}
public String getGrade() {
return grade;
}
public void setGrade(String grade) {
this.grade = grade;
}

}

这个是我的代码，跟你的很类似，方法参照一下就好了的，还有最后要关闭rs,pstmt和connect资源

1、不要手动拼接sql
2、用prepareStatement
3、用ORM框架