数据库语句与Java字符串的结合使用

sqlStr = "select * from shop_user where username = '"                     + user.getUserName() + "'";             sqlStr = "insert into shop_user (username,password,Names,sex,"                     + "Address,Phone,Post,Email,RegTime,RegIpaddress) values ('";             sqlStr = sqlStr + dataFormat.