sql注入風險解決

Connection conn = DriverManager.getConnection(DBUrl, DBUser, DBPassword);

String sql = "SELECT * FROM user WHERE username = '" + userName + "'";
Statement stmt1 = conn.createStatement();
ResultSet name = stmt1.executeQuery(sql);

怎樣修改