jsp与sql语句怎么混合使用

String sql="insert into allorder values('" + orderid + "','" + bookid +"','" + alinuxjishu/9952.html target=_blank class=infotextkey>mount + "','" + username + "')";
int result=stmt.executeUpdate(sql);
if(result==1)
response.sendRedirect("index.jsp");
else
response.sendRedirect("detail.jsp");
 

String condition="delete from allorder where id='"+ orderid+ "'";
int result=stmt.executeUpdate(condition);
 
if(result==1)
response.sendRedirect("index.jsp");
else
out.println("shopCar.jsp");
 

<%
while (rs.next()){
String amount=rs.getString("amount");
String orderid=rs.getString("id");
String bookname=rs.getString("name");
String price=rs.getString("price");
String picture=rs.getString("pic");
 
//out.println("tshuliang"+amount);
%>
<tr><td><%=orderid %></td><td><%=picture %></td><td><%=bookname %></td><td><%=price %></td><td><%=amount %></td><td><table><tr><td><input type="button" value="删除" onclick="window.location.href='delete.jsp?orderid=<%=orderid %>'"></td></tr></table></td></tr>
<%
}
// 关闭连接
stmt.close();// 关闭命令对象连接
con.close();// 关闭数据库连接
} catch (SQLException e) {
e.printStackTrace();
out.println("数据库连接错误");
System.exit(0);
}
//数据库连接完成
%>
</table>