j2ee开发，JSP、SQL Server环境下一个关于RS应用的问题

Question

<%@ page language="java" import="java.util.*,java.sql.*,com.dao.*" pageEncoding="utf-8"%>
<% 
Class.forName("com.microsoft.sqlserver.jdbc.SQLServerDriver");
String url = "jdbc:sqlserver://127.0.0.1:1433;DatabaseName=AB";
String uid = "sa";
String pwd = "123";
Connection conn = DriverManager.getConnection(url,uid,pwd);
PreparedStatement pstmt;
String name = request.getParameter("Name");
String password = request.getParameter("Password");
String sqlTemp = "select * from USER where name=" + name;
pstmt = conn.prepareStatement(sqlTemp);ResultSet rs = pstmt.executeQuery();                                        //这两句一加上就出错，不加
if (rs.next()) {out.print("<script type='text/javascript'>alert('名字已存在');window.location='home.jsp'</script>");}                                //的话可以正常添加用户
String sql =  "insert into USER(name,password) values (?,?)";
pstmt = conn.prepareStatement(sql);
pstmt.setString(1,name);
pstmt.setString(2,password);
pstmt.execute();
conn.commit();
pstmt.close();
conn.close();
out.print("<script type='text/javascript'>alert('添加成功');window.location='home.jsp'</script>");
%>
标记的两句有问题，实在看不出来为什么错。我是初学，请各位不吝指教！谢谢

Answer 1

随便添加一个用户名为“yy”，错误提示：
HTTP Status 500 - --------------------------------------------------------------------------------type Exception reportmessage description The server encountered an internal error () that prevented it from fulfilling this request.exception org.apache.jasper.JasperException: An exception occurred processing JSP page /add.jsp at line 1411: 
12: String sqlTemp = "select * from T_USER where user_name=" + name;
13: pstmt = conn.prepareStatement(sqlTemp);
14: ResultSet rs = pstmt.executeQuery();
15: if (rs.next()) {out.print("<script type='text/javascript'>alert('鍚嶅瓧宸插瓨鍦�');window.location='userhome.jsp'</script>");}
16: 
17: 
Stacktrace:
org.apache.jasper.servlet.JspServletWrapper.handleJspException(JspServletWrapper.java:519)
org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:410)
org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:313)
org.apache.jasper.servlet.JspServlet.service(JspServlet.java:260)
javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
root cause javax.servlet.ServletException: com.microsoft.sqlserver.jdbc.SQLServerException: 列名 'yy' 无效。
org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:865)
org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:794)
org.apache.jsp.add_jsp._jspService(add_jsp.java:98)
org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:386)
org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:313)
org.apache.jasper.servlet.JspServlet.service(JspServlet.java:260)
javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
root cause com.microsoft.sqlserver.jdbc.SQLServerException: 列名 'yy' 无效。
com.microsoft.sqlserver.jdbc.SQLServerException.makeFromDatabaseError(SQLServerException.java:197)
com.microsoft.sqlserver.jdbc.SQLServerStatement.getNextResult(SQLServerStatement.java:1493)
com.microsoft.sqlserver.jdbc.SQLServerPreparedStatement.doExecutePreparedStatement(SQLServerPreparedStatement.java:390)
com.microsoft.sqlserver.jdbc.SQLServerPreparedStatement$PrepStmtExecCmd.doExecute(SQLServerPreparedStatement.java:340)
com.microsoft.sqlserver.jdbc.TDSCommand.execute(IOBuffer.java:4575)
com.microsoft.sqlserver.jdbc.SQLServerConnection.executeCommand(SQLServerConnection.java:1400)
com.microsoft.sqlserver.jdbc.SQLServerStatement.executeCommand(SQLServerStatement.java:179)
com.microsoft.sqlserver.jdbc.SQLServerStatement.executeStatement(SQLServerStatement.java:154)
com.microsoft.sqlserver.jdbc.SQLServerPreparedStatement.executeQuery(SQLServerPreparedStatement.java:283)
org.apache.jsp.add_jsp._jspService(add_jsp.java:71)
org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:386)
org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:313)
org.apache.jasper.servlet.JspServlet.service(JspServlet.java:260)
javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
note The full stack trace of the root cause is available in the Apache Tomcat/6.0.30 logs.

Answer 2

String sqlTemp = "select * from USER where name='" + name+"'";

Answer 3

select * from USER where name=yy
将yy当成列名
select * from USER where name='yy'
yy就是一个字符串了

Answer 4

那个if(rs.next())的判断没器作用

Answer 5

上面用  pstmt.setString(1,name);给sql语句赋值

Answer 6

有的,你在里边加一个return就可以了.