JSP模糊查询查不到数据不知道那块写错了求解！

jsp页面

请输入药品名称:<input type="text" id="yname">
        类型:<select id="ytype">
                    <option value="">---请选择---</option>
                    <c:forEach var="MedicineType" items="${list2}">
                        <option value="${MedicineType.medicineTypeId}">${MedicineType.typeName}</option>
                    </c:forEach>
            </select>
            <button id="search">搜索</button>



jquery脚本
  $("#search").click(function() {
              let yname=$("#yname").val();
              let ytype=$("#ytype").val();
              location.href="selectByNameAndType?yname="+yname+"&ytype="+ytype;
          })


selectByNameAndType类

protected void doGet(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        request.setCharacterEncoding("UTF-8");
        String yname=request.getParameter("yname");
        String ytype=request.getParameter("ytype");
        MedicineDao medicineDao=new MedicineDao();
        ArrayList<Medicine> list=medicineDao.queryByNameAndType(yname,ytype);
        request.setAttribute("list", list);
        request.getRequestDispatcher("index.jsp").forward(request, response);
    }

这是dao类查询SQL语句的方法
 public ArrayList<Medicine> queryByNameAndType(String yname, String ytype) {
        ArrayList<Medicine> list=new ArrayList<Medicine>();
        Connection con=null;
        PreparedStatement sta=null;
        ResultSet rs=null;
        con=DBUtil.getCon();
        String sql="SELECT * FROM Medicine WHERE 1=1";
        if (yname!=""){
            sql+="AND  NAME='"+yname+"'";
        }
        if (ytype!=""){
            sql+="AND  typeId='"+ytype+"'";
        }
        try{
            sta=con.prepareStatement(sql);
            rs=sta.executeQuery();
            while (rs.next()){
                Medicine medicine=new Medicine(rs.getInt(1),
                        rs.getString(2),rs.getFloat(3),
                        rs.getString(4),rs.getInt(5));
                list.add(medicine);
            }
        } catch (SQLException throwables) {
            throwables.printStackTrace();
        }finally {
            DBUtil.close(rs,sta,con);
        }
        return list;
    }

AND前面加空格，要不然sql报错

根据什么字段模糊查询？name？

你不是要模糊查询吗，为什么sql语句where条件都是用=，而不是like