这样的sql查询在jsp中如何写?

[Stnyu]

我要将userid,password作为查询条件在jsp中应该如何写，是这样吗:
String Userid=request.getParameter("userid");
String Password=request.getParameter("password");
...
rs_user=state.executeQuery("select * from userInfo where user_id=Userid and password=Password order by user_id")
我知道不对啦，我想要个正确答案

[BrentIvan]

rs_user=state.executeQuery("select * from userInfo where user_id = '" + Userid + "' and password = '" + Password + "' order by user_id")

[zhuzhichao]

同意樓上的寫法.
字符串兩邊要有單引號.

[hexiaofeng]

String sql = "select * from userInfo where user_id = "+'"' + Userid +'"'+ " and password = "+'"' + Password +'"'+ " order by user_id";
rs_user=state.executeQuery(sql);

[nielinjie]

hexiaofeng(java爱好者)　写的明显不对

[hexiaofeng]

to nielinjie(nielinjie)　
你试过了么?没有吧?呵呵,我试过了,好用!!!

[Stnyu]

各位,谢谢,谢谢 我试过楼顶的写法可以,但是的二种还没试

[zset]

用存储过程