[将变量放入Java字符串中以供mysql查询使用的方法，我们可以使用吗？在子查询中选择[重复项

Question

此问题已经在这里有了答案：

• passing parameters to a JDBC PreparedStatement6个答案

我想在子选择查询的mysql查询中插入Java字符串中的变量

 String cid=request.getParameter("cid");
 String sql2 ="select bname from brands where bid in ( Select bid from catbrand where cid = '"+ cid +"' )   ";
 ps =connection.prepareStatement(sql2);
 resultSet = ps.executeQuery(sql2);   

Answer 1

String cid=request.getParameter("cid");
String sql2 = "select bname from brands where bid in ( select bid from catbrand where cid=? )";
ps = connection.prepareStatement(sql2);
ps.setString(1, cid);
resultSet = ps.executeQuery();