exemplo sql injection

String nome = "Leonardo";
String senha = "' or 1=1 #";

Connection cnn = DriverManager.getConnection("jdbc:mysql://localhost/sql_injection", "root", "");
PreparedStatement statement = cnn.prepareStatement("select * from Usuario where nome = '" + nome + "' and senha='" + senha + "';");
ResultSet resultSet = statement.executeQuery();

while(resultSet.next())
	System.out.println(resultSet.getString("nome"));