String sql="select * from A where name='%?%'"
　PreparedStatement ps=con.prepareStatement(sql);
　ps.setString(1, "张三");

public void update(String sql, String param[]) throws Exception {
    Connection con = getCon();
    PreparedStatement ps = con.prepareStatement(sql);
    for (int i = 0; i < param.length; i++) {
      ps.setString(i + 1, param[i]);
    }
    ps.execute();
    closeAll(null, ps, con);
  }