PreparedStatement是如何防止sql注入的？

PreparedStatement对象防止sql的方式是把用户非法输入的单引号用\反斜杠做了转义。例如：

select * from user where account = '小明' and password = '6' or '1' = '1'
转义后
select * from user where account = '小明' and password = '6\' or \'1\' = \'1'

select * from user where account = '小明' and password = ''; drop table user;#'
转义后
select * from user where account = '小明' and password = '\'; drop table user;#'

在实现PreparedStatement接口的实现类中的setString(int parameterIndex, String x)函数中做了一些处理，把单引号做了转义(只要用户输入的字符串中有单引号，那mysql数据库产商的setString()这个函数，就会把单引号做转义)