String sql = "SELECT id, name, orders, link, color, parent_id FROM productnav WHERE parent_id=? order by orders";
List l = null;
try {
    PreparedStatement ps = conn.prepareStatement(sql);
    ps.setString(1, parentId);
    ResultSet rs = ps.executeQuery(sql);
    l = new ArrayList();
    while(rs.next()){
        ProductNav nav = new ProductNav();
        nav.setId(rs.getString(1));
        nav.setName(rs.getString(2));
        nav.setOrders(rs.getInt(3));
        nav.setLink(rs.getString(4));
        nav.setColor(rs.getString(5));
        nav.setParentId(rs.getString(6));
        l.add(nav);
    }
}catch(SQLException e){
    e.printStackTrace();
    log.error(e.getMessage());
}

com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: You have an error in your SQL syntax; check the manual that corresponds to your MySQL server version for the right syntax to use near '? order by orders' at line 1
    at com.mysql.jdbc.SQLError.createSQLException(SQLError.java:936)
    at com.mysql.jdbc.MysqlIO.checkErrorPacket(MysqlIO.java:2934)
    at com.mysql.jdbc.MysqlIO.sendCommand(MysqlIO.java:1616)
    at com.mysql.jdbc.MysqlIO.sqlQueryDirect(MysqlIO.java:1708)
    at com.mysql.jdbc.Connection.execSQL(Connection.java:3249)
    at com.mysql.jdbc.Connection.execSQL(Connection.java:3178)
    at com.mysql.jdbc.Statement.executeQuery(Statement.java:1203)
    at org.apache.commons.dbcp.DelegatingStatement.executeQuery(DelegatingStatement.java:205)
    at com.wyx.common.database.impl.MysqlOperation.listProductChildNav(MysqlOperation.java:109)
    at com.wyx.actions.admin.ProductNavAction.listChilds(ProductNavAction.java:134)
    at sun.reflect.NativeMethodAccessorImpl.invoke0(Native Method)
    at sun.reflect.NativeMethodAccessorImpl.invoke(NativeMethodAccessorImpl.*/
    public Object[] readNode(String nodeName) {
        Object nodeValue[]=null;
        NodeList nodelist = doc.getElementsByTagName(nodeName);
        nodeValue=new Object[nodelist.getLength()];
        //System.out.println("getLength:" + nodelist.getLength());
        //System.out.println("getNodeName"+"\t"+"getNodeValue"+"\t"+"getAttribute");
        for (int i = 0; i < nodelist.getLength(); i++) {
            Element element =(Element)nodelist.item(i);
            //System.out.println(element.getNodeName()+"\t"+element.getNodeValue()+"\t"+element.getAttribute("num"));
            nodeValue[i]=element.getNodeValue();
        }
        return nodeValue;
    }
    
    /**
     * 读取XML文件节点属性内容
     * @param nodeName 节点名称
     * @param Attribute 节点属性名称
     * @return
     */
    public Object[] readNode(String nodeName,String Attribute) {
        Object AttrValue[]=null;
        NodeList nodelist = doc.getElementsByTagName(nodeName);
        AttrValue=new Object[nodelist.getLength()];
        for (int i = 0; i < nodelist.getLength(); i++) {
            Element element =(Element)nodelist.item(i);
            //System.out.println(element.getNodeName()+"\t"+element.getNodeValue()+"\t"+element.getAttribute("num"));
            AttrValue[i]=element.getAttribute(Attribute);
        }
        return AttrValue;
    }
    
    public uDom() {
        // TODO Auto-generated constructor stub
        try {
            this.readxml();
        } catch (ParserConfigurationException e) {
            e.printStackTrace();
        } catch (SAXException e) {
            e.printStackTrace();
        } catch (IOException e) {
            e.printStackTrace();
        }
    }

    public void readxml() throws ParserConfigurationException, SAXException,
            IOException {
        
        String nodename = null;

        short nodetype = 0;

        String nodevalue = null;
        
        DocumentBuilder dbf = DocumentBuilderFactory.newInstance().newDocumentBuilder();
        System.out.println("Get DocumentBuilder Successful...");

        Document doc = dbf.parse("d:/TestFile/links.xml");
        System.out.println("Get Document Successful...");

        NodeList nl1 = doc.getElementsByTagName("message");
        System.out.println("Get NodeList(links) Successful...");
        System.out.println("getLength:" + nl1.getLength());

        Node node2 = doc.getFirstChild().getChildNodes().item(1);
        // Node node3 = doc.getFirstChild();
        Node node1 = nl1.item(4);
        // Node node2 = doc.getFirstChild();

        // Node node3 = node2.getFirstChild();
        // Node node4 = node3.getFirstChild();
        for (int i = 0; i < 2; i++) {
            System.out.println(node2.getChildNodes().item(i).getNodeName());
            System.out.println(node2.getChildNodes().item(i).getNodeValue());
        }

        // System.out.println(node2.getFirstChild().getNextSibling().getNodeName());
        System.exit(0);

        nodename = node1.getFirstChild().getNodeName();

        nodetype = node1.getFirstChild().getNodeType();

        nodevalue = node1.getFirstChild().getNodeValue();

        System.out.println("getNodeName:" + nodename);
        System.out.println("getNodeType:" + nodetype);
        System.out.println("getNodeValue:" + nodevalue);
    }

    /**
     * @param args
     */
    public static void main(String[] args) {
        // TODO Auto-generated method stub
        uDom udom = new uDom("xml/test.XML");
        System.out.println("读取XML文件成功~~");
        Object[] temp=udom.readNode("root","num");
        System.out.println("获得节点长度为:"+temp.length);
        for(int i=0;i<temp.length;i++) {
            //temp[i]可能会得到空指针异常
            System.out.println(i+" Value: "+temp[i].toString());
        }
    }

}