JDBC_Sql_injection sql注入

package Java_JDBC;

import java.sql.*;
import java.util.Scanner;


/**
 *
 * SQl注入攻击
 */
public class JDBC_Sql_injection {
    public static void main(String[] args) throws ClassNotFoundException, SQLException {
        Class.forName("com.mysql.jdbc.Driver");
        String url = "jdbc:mysql://192.168.8.14:3306/day22_JDBC";
        String user = "root";
        String password = "123456";
        Connection con = DriverManager.getConnection(url,user,password);
        Statement st = con.createStatement();

        Scanner sc = new Scanner(System.in);
        String username = sc.nextLine();
        String passwd = sc.nextLine();

        String sql = " select * from users where username='"+username+"' and PASSWORD='"+passwd+"'";
        System.out.println(sql);

        ResultSet rs = st.executeQuery(sql);
//        System.out.println(rs.next());

        while (rs.next()){
            System.out.println(rs.getString("username")+ "   "+rs.getString("PASSWORD"));
        }

        rs.close();
        st.close();
        con.close();


    }
}