这样sql查询在jsp中如何写?

[Stnyu]

我要将userid,password作为查询条件在jsp中应该如何写，是这样吗:
String Userid=request.getParameter("userid");
String Password=request.getParameter("password");
...
rs_user=state.executeQuery("select * from userInfo where user_id=Userid and password=Password order by user_id")
我知道不对啦，我想要个正确答案

[BrentIvan]

state.executeQuery("select * from userInfo where user_id='" + Userid + "' and password='" + Password + "' order by user_id")

[Stnyu]

阿蛋,谢谢,谢谢喽

[wyzegg]

已答