// 假設(shè) searchTerm 已經(jīng)根據(jù)類型判斷并設(shè)置了相應(yīng)的條件
// ...
// String FETCH_USER_BY_SEARCHTERM = "SELECT * FROM SignUpTable WHERE ? = ? "; // 原始查詢字符串

// 在條件分支中設(shè)置參數(shù)
if (searchTerm.contains(".com") && searchTerm.contains("@")) {
    // System.out.println("In email check");
    psmt.setString(1, "EMAIL_ID"); // 嘗試將列名作為參數(shù)
    psmt.setString(2, searchTerm);
} else if (numresult == true){ // numresult 假定為之前判斷手機(jī)號(hào)的結(jié)果
    // System.out.println("In number check");
    psmt.setString(1, "MOBILE_NUMBER"); // 嘗試將列名作為參數(shù)
    psmt.setString(2, searchTerm);
} else if (uresult == true || alphanumeic == true) { // uresult/alphanumeic 假定為之前判斷用戶名的結(jié)果
    // System.out.println("In username check");
    psmt.setString(1, "USER_NAME"); // 嘗試將列名作為參數(shù)
    psmt.setString(2, searchTerm);
}

rs = psmt.executeQuery(); // 執(zhí)行查詢
// ... 處理結(jié)果集

String FETCH_USER_BY_SEARCHTERM = "SELECT * FROM SignUpTable WHERE ? = ? ";

SELECT * FROM SignUpTable WHERE 'EMAIL_ID' = 'user@example.com';

import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;

public class UserSearchService {

    private Connection connection; // 假設(shè)connection已初始化

    public UserSearchService(Connection connection) {
        this.connection = connection;
    }

    public HomeVo findUserBySearchTerm(String searchTerm, boolean numresult, boolean uresult, boolean alphanumeric) throws SQLException {
        String columnToSearch;

        // 1. 根據(jù)搜索詞類型確定要查詢的列名
        if (searchTerm.contains(".com") && searchTerm.contains("@")) {
            columnToSearch = "EMAIL_ID";
        } else if (numresult) { // 假設(shè)numresult為true表示是手機(jī)號(hào)
            columnToSearch = "MOBILE_NUMBER";
        } else if (uresult || alphanumeric) { // 假設(shè)uresult或alphanumeric為true表示是用戶名
            columnToSearch = "USER_NAME";
        } else {
            // 如果無(wú)法判斷類型，可以拋出異常或設(shè)置默認(rèn)列
            throw new IllegalArgumentException("無(wú)法識(shí)別的搜索詞類型");
        }

        // 2. 安全地構(gòu)建SQL查詢字符串
        // 確保 columnToSearch 只能是預(yù)定義的合法列名，防止SQL注入
        // 這是一個(gè)簡(jiǎn)單的白名單檢查，更復(fù)雜的應(yīng)用可能需要更嚴(yán)格的驗(yàn)證
        if (!isValidColumn(columnToSearch)) {
            throw new IllegalArgumentException("非法的查詢列名: " + columnToSearch);
        }

        String sql = "SELECT ID, FIRST_NAME, LAST_NAME, EMAIL_ID, MOBILE_NUMBER, QUALIFICATION, STATE, GENDER, USER_NAME, DOB FROM SignUpTable WHERE " + columnToSearch + " = ?";
        PreparedStatement psmt = null;
        ResultSet rs = null;
        HomeVo vo = null;

        try {
            psmt = connection.prepareStatement(sql);
            psmt.setString(1, searchTerm); // 現(xiàn)在searchTerm作為值被參數(shù)化

            // 調(diào)試：打印預(yù)處理語(yǔ)句，查看實(shí)際執(zhí)行的SQL
            System.out.println("Executing SQL: " + psmt.toString());

            rs = psmt.executeQuery();

            if (rs.next()) { // 使用if而不是while，因?yàn)橥ǔＶ黄谕祷匾粋€(gè)用戶
                vo = new HomeVo();
                vo.setId(rs.getInt("ID"));
                vo.setFirstName(rs.getString("FIRST_NAME"));
                vo.setLastName(rs.getString("LAST_NAME"));
                vo.setEmailId(rs.getString("EMAIL_ID"));
                vo.setNumber(rs.getString("MOBILE_NUMBER"));
                vo.setQualification(rs.getString("QUALIFICATION"));
                vo.setState(rs.getString("STATE"));
                vo.setGender(rs.getString("GENDER"));
                vo.setUserName(rs.getString("USER_NAME"));
                vo.setDob(rs.getString("DOB"));
            }
        } finally {
            // 關(guān)閉資源
            if (rs != null) try { rs.close(); } catch (SQLException ignore) {}
            if (psmt != null) try { psmt.close(); } catch (SQLException ignore) {}
        }
        return vo;
    }

    // 輔助方法：校驗(yàn)列名是否合法，防止SQL注入
    private boolean isValidColumn(String column) {
        return "EMAIL_ID".equals(column) || "MOBILE_NUMBER".equals(column) || "USER_NAME".equals(column);
    }

    // 假設(shè) HomeVo 類已經(jīng)定義
    static class HomeVo {
        private int id;
        private String firstName;
        private String lastName;
        private String emailId;
        private String number;
        private String qualification;
        private String state;
        private String gender;
        private String userName;
        private String dob;

        // Getters and Setters
        public int getId() { return id; }
        public void setId(int id) { this.id = id; }
        public String getFirstName() { return firstName; }
        public void setFirstName(String firstName) { this.firstName = firstName; }
        public String getLastName() { return lastName; }
        public void setLastName(String lastName) { this.lastName = lastName; }
        public String getEmailId() { return emailId; }
        public void setEmailId(String emailId) { this.emailId = emailId; }
        public String getNumber() { return number; }
        public void setNumber(String number) { this.number = number; }
        public String getQualification() { return qualification; }
        public void setQualification(String qualification) { this.qualification = qualification; }
        public String getState() { return state; }
        public void setState(String state) { this.state = state; }
        public String getGender() { return gender; }
        public void setGender(String gender) { this.gender = gender; }
        public String getUserName() { return userName; }
        public void setUserName(String userName) { this.userName = userName; }
        public String getDob() { return dob; }
        public void setDob(String dob) { this.dob = dob; }
    }
}