关于JavaWeb的数据库的问题？
import java.io.*;
import java.sql.SQLException;
import java.util.*;

import javax.servlet.*;
import javax.servlet.http.*;

public class StudentServlet extends HttpServlet{
public void doGet(HttpServletRequest req, HttpServletResponse res)
throws ServletException, IOException{
  this.doPost(req,res);
  }  
  public void doPost(HttpServletRequest req, HttpServletResponse res)
throws ServletException,IOException{
  res.setCharacterEncoding("GBK"); //设置res编码为GBK
  req.setCharacterEncoding("GBK"); //设置req编码为GBK
  HttpSession session = req.getSession(); //得到session对象
  String action = req.getParameter("action"); //得到action动作
  String message = ""; //声明消息字符串
String stuNO = (String)session.getAttribute("stuNO");//得到当前登陆的学生信息
StuDB sdb=new StuDB();
  //DBUtil dbu = (DBUtil)wac.getBean("DBUtil"); //得到DBUtil对象
  if(action.equals("login")){
stuNO = req.getParameter("uname").trim(); //得到登陆用户名
String pwd = req.getParameter("pwd").trim(); //得到登陆密码
try {
41行在这里 if((sdb.verify(stuNO,pwd))){ //登陆成功
List<Student> all = sdb.getStuInfo(stuNO);//执行查询得到该学生信息
Iterator<Student> iter = all.iterator();
//遍历输出所有用户信息
while(iter.hasNext()) {
Student s = iter.next();
System.out.println(s.getStudentNO());
System.out.println(s.getPassword());
System.out.println("您的名字"+s.getName());
System.out.println(s.getAge());
System.out.println(s.getGender());
System.out.println(s.getClasss());
System.out.println(s.getDepartment());
System.out.println("你的借书权限"+s.getPermitted());
session.setAttribute("stuNO",s.getStudentNO()); //将学号放进session
session.setAttribute("stuName",s.getName()); //将学生姓名放进session
}
}
else{
message = "非法的用户名和密码，请核对后重新登陆。"; //登陆失败消息
req.setAttribute("message", message); //设置消息
}
} catch (SQLException e) {
// TODO Auto-generated catch block
e.printStackTrace();
}
req.getRequestDispatcher("login.jsp").forward(req,res); //转发置login页面
  }
}




import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;
import java.util.*;
import java.io.*;
import org.springframework.jdbc.core.*;

public class StuDB {
private String sql = null; //声明SQL字符串引用
DataBaseConnection dbc = null ;
PreparedStatement pstmt = null ;
Student stu=null;
public boolean verify(String StuNO,String pwd) throws SQLException{ //登陆验证
boolean result = false; //登陆成功失败标志
String sql = "SELECT * FROM student WHERE StudentNO='?',Password='?'" ;
dbc = new DataBaseConnection() ;
pstmt = dbc.getConnection().prepareStatement(sql) ;
27行在这里 pstmt.setString(1,StuNO);
pstmt.setString(2,pwd);
ResultSet rs = pstmt.executeQuery() ;
  if(rs.next()){ //判断查询结果
  result = true;//如果存在用户则值标志位为true
  }
  rs.close() ;