Seek solution, project running error, do not know what the problem is

If you have two parameters in sql, you need to set two parameters later, one name and one password.

sql error.
You should not write question marks in sql because this is a query condition.
"select * from s_admin where name="+name value +" and password="+password value
name value and password value from the Admin object parameter you passed

call you this sql place how to write, the name and password directly concatenated into the sql inside, can be called directly, but there is the risk of sql injection, with the question mark, I'm going to pass in a name like password