SQL Inject Found in one_page_student

[p0l42]

I found a sql inject in one_page_student.findWithId/findWithName.
Set a breakpoint as follows:

When I use payload one_page_student?key=1' or '1'='1，it hits the breakpoint.


After executing String sql=...， sql becomes

After executing sql query, al is filled with information