String param = "'test' or 1=1";
String sql = "select file from file where name = " + param; // 拼接SQL参数
PreparedStatement preparedStatement = connection.prepareStatement(sql);
ResultSet resultSet = preparedStatement.executeQuery();
System.out.println(resultSet.next());

-- 永真条件1=1成为了查询条件的一部分，可以返回所有数据，造成了SQL注入问题select file from file where name = 'test' or 1=1 

String param = "'test' or 1=1";
String sql = "select file from file where name = ?";
PreparedStatement preparedStatement = connection.prepareStatement(sql);
preparedStatement.setString(1, param);
ResultSet resultSet = preparedStatement.executeQuery();
System.out.println(resultSet.next());

select file from file where name = '\'test\' or 1=1'

An object that represents a precompiled SQL statement.A SQL statement is precompiled and stored in a PreparedStatement object. This object can then be used to efficiently execute this statement multiple times.

    public void setString(int parameterIndex, String x) throws SQLException {synchronized (checkClosed().getConnectionMutex()) {// if the passed string is null, then set this column to nullif (x == null) {setNull(parameterIndex, Types.CHAR);} else {checkClosed();int stringLength = x.length();if (this.connection.isNoBackslashEscapesSet()) {// Scan for any nasty chars                    // 判断是否需要转义处理（比如包含引号，换行等字符）boolean needsHexEscape = isEscapeNeededForString(x, stringLength); // 如果不需要转义，则在两边加上单引号if (!needsHexEscape) {byte[] parameterAsBytes = null;StringBuilder quotedString = new StringBuilder(x.length() + 2);quotedString.append('\'');quotedString.append(x);quotedString.append('\'');...} else {...}String parameterAsString = x;boolean needsQuoted = true; // 如果需要转义，则做转义处理if (this.isLoadDataQuery || isEscapeNeededForString(x, stringLength)) {...

Before bind: com.mysql.jdbc.JDBC42PreparedStatement@b1a58a3: select file from file where name = ** NOT SPECIFIED **
After bind: com.mysql.jdbc.JDBC42PreparedStatement@b1a58a3: select file from file where name = '\'test\' or 1=1'