多條件查詢Dao和Servlet

Dao

public List<Borrow> queryBorrowByBookNameAndStudentNameAndClassName(String bookName, String studentName,
			String clsName) {
		List<Borrow> list = new ArrayList<Borrow>();
		String sql = "select id,name,borrowDate,sid from tbl_borrow where 1=1 ";
		if (bookName != null && !"".equals(bookName)) {
			sql = sql + " and name='" + bookName + "'";
		}

		if (studentName != null && !"".equals(studentName)) {
			sql = sql + " and sid in(select id from tbl_student where name='" + studentName + "')";
		}

		if (clsName != null && !"".equals(clsName)) {
			sql = sql + " and sid in(select id from tbl_student where cls='" + clsName + "')";
		}

		Connection con = null;
		Statement st = null;
		ResultSet rs = null;
		try {
			con = JDBCUtil.getConnection();
			st = con.createStatement();
			rs = st.executeQuery(sql);
			while (rs.next()) {
				Borrow borrow = new Borrow();
				borrow.setId(rs.getInt("id"));
				borrow.setName(rs.getString("name"));
				borrow.setBorrowDate(rs.getTimestamp("borrowDate"));
				borrow.setSid(rs.getInt("sid"));
				list.add(borrow);
			}
		} catch (Exception e) {
			e.printStackTrace();
		} finally {
			JDBCUtil.closeJDBC(con, st, rs);
		}
		return list;
	}

	public boolean checkBooName(String bookName) {
		boolean flag=true;
		String sql = "select id,name,borrowDate,sid from tbl_borrow where name='"+bookName+"'";
		Connection con = null;
		Statement st = null;
		ResultSet rs = null;
		try {
			con = JDBCUtil.getConnection();
			st = con.createStatement();
			rs = st.executeQuery(sql);
			if(rs.next()) {
				flag=false;
			}
		} catch (Exception e) {
			e.printStackTrace();
		} finally {
			JDBCUtil.closeJDBC(con, st, rs);
		}
		return flag;
	}

Servlet

package com.project.controller;

import java.io.IOException;
import java.util.List;
import java.util.Map;

import javax.servlet.ServletException;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;

import com.project.dao.BorrowDao;
import com.project.dao.StudentDao;
import com.project.pojo.Borrow;
import com.project.pojo.Student;

public class SelectBorrowServlet extends HttpServlet {
	private static final long serialVersionUID = 1L;
	private BorrowDao borrowDao;
	private StudentDao studentDao;

	public SelectBorrowServlet() {
		borrowDao = new BorrowDao();
		studentDao = new StudentDao();
	}

	protected void doGet(HttpServletRequest request, HttpServletResponse response)
			throws ServletException, IOException {
		doPost(request, response);
	}

	protected void doPost(HttpServletRequest request, HttpServletResponse response)
			throws ServletException, IOException {
		request.setCharacterEncoding("UTF-8");
		response.setCharacterEncoding("UTF-8");
		response.setContentType("text/html; charset=UTF-8");
		String bookName=request.getParameter("bookname");
		String studentName=request.getParameter("studentname");
		String clsName=request.getParameter("clsname");
		List<Borrow> blist=borrowDao.queryBorrowByBookNameAndStudentNameAndClassName(bookName,studentName,clsName);
		List<String> clist = studentDao.queryAllClassName();
		Map<Integer, Student> smap = studentDao.queryAllStudent();
		request.setAttribute("blist", blist);
		request.setAttribute("smap", smap);
		request.setAttribute("clist", clist);
		
		this.getServletContext().getRequestDispatcher("/list.jsp").forward(request, response);
	}

}