写数据库 乱吗问题

我在想数据库写纪录是
用
String sql =
"insert into menu (id,pid,txt,title,link,target,isvisible,xicon) values(" +
item.getId() + "," + item.getPid() + ",'" + item.getTxt() + "','" +
item.getTitle() + "','" + item.getLink() + "','" + item.getTarget() +
"'," + visible + ",'" + item.getXicon() + "')";
logger.debug(sql);
try {
stmt = conn.createStatement();
stmt.executeUpdate(sql);
就不是乱吗



String strSql =
"insert into user_info values(?,?,?,?,?,?,?,?,?,?,?,?,?,?,?,?)";
try {
PreparedStatement pstmt = conn.prepareStatement(strSql);
pstmt.setString(1, user.getUserid());
pstmt.setString(2, user.getName());
pstmt.setString(3, user.getPhone());
pstmt.setString(4, user.getStreet());
pstmt.setString(5, user.getProvince());
pstmt.setString(6, user.getCity());
pstmt.setString(7, user.getZipCode());
pstmt.setString(8, user.getEmail());
pstmt.setString(9, user.getCardNumber());
pstmt.setString(10, user.getCardType());
pstmt.setInt(11, 0);


pstmt.executeUpdate();
pstmt.close();

就是乱吗
郁闷！！！！！！！！！！！！！！！！！！！！！！！！！！！！！
那位GGJJ能给解释一下吗