Comment le mécanisme de sécurité Java empêche-t-il les attaques par injection SQL ?

import java.util.regex.Pattern;

// 验证电子邮件地址格式
public class EmailValidator {
    private static final Pattern VALID_EMAIL_REGEX = Pattern.compile("^[\\w!#$%&'*+/=?`{|}~^-]+(?:\\.[\\w!#$%&'*+/=?`{|}~^-]+)*@(?:[a-zA-Z0-9-]+\\.)+[a-zA-Z]{2,6}$");

    public static boolean isValid(String email) {
        return VALID_EMAIL_REGEX.matcher(email).matches();
    }
}

import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.SQLException;

// 使用预处理语句执行查询
public class PreparedStatementExample {
    public static void main(String[] args) throws SQLException {
        // 获取数据库连接
        Connection connection = ...

        // 创建预处理语句
        String query = "SELECT * FROM users WHERE username = ?";
        PreparedStatement statement = connection.prepareStatement(query);

        // 设置参数
        statement.setString(1, "user1");

        // 执行查询
        ResultSet resultSet = statement.executeQuery();

        // 遍历结果集
        while (resultSet.next()) {
            System.out.println(resultSet.getString("username"));
        }

        // 关闭连接和预处理语句
        statement.close();
        connection.close();
    }
}

import javax.persistence.Entity;
import javax.persistence.Id;
import javax.persistence.Table;

// 使用 JPA 定义实体类
@Entity
@Table(name = "users")
public class User {
    @Id
    private Long id;
    private String username;
    private String password;
}

import javax.servlet.ServletException;
import javax.servlet.annotation.WebServlet;
import javax.servlet.http.HttpServlet;
import javax.servlet.http.HttpServletRequest;
import javax.servlet.http.HttpServletResponse;
import java.io.IOException;
import java.sql.Connection;
import java.sql.PreparedStatement;
import java.sql.ResultSet;
import java.sql.SQLException;

@WebServlet("/LoginServlet")
public class LoginServlet extends HttpServlet {
    protected void doPost(HttpServletRequest request, HttpServletResponse response) throws ServletException, IOException {
        // 验证输入
        String username = request.getParameter("username");
        if (!EmailValidator.isValid(username)) {
            response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
            return;
        }

        String password = request.getParameter("password");
        if (password == null || password.isEmpty()) {
            response.setStatus(HttpServletResponse.SC_BAD_REQUEST);
            return;
        }

        // 使用预处理语句执行查询
        Connection connection = ...
        String query = "SELECT * FROM users WHERE username = ?";
        PreparedStatement statement = connection.prepareStatement(query);
        statement.setString(1, username);

        ResultSet resultSet = statement.executeQuery();
        if (resultSet.next()) {
            // 找到了用户，校验密码
            String storedPassword = resultSet.getString("password");
            if (password.equals(storedPassword)) {
                // 登录成功
                response.sendRedirect("/success.jsp");
                return;
            }
        }

        // 登录失败
        response.sendRedirect("/login.jsp?error=invalid-credentials");
    }
}