sql赋值语句insert问题

Question

String username=request.getParameter("r_user");
String password=request.getParameter("r_password");
String msg=null;
sql=conn.createStatement();
rs=sql.executeQuery("select * from user where username="+username);
if(!rs.next()){String UpdateCondition="insert into user(username,password) value(username,password)";
这个赋值语句不执行啊，value后面的值是获取了text里面输入的值的变量，这两个变量是否需要加‘或者“呢

Answer 1

rs=sql.executeQuery("select * from user where username='"+username+"'");