Jfinal報錯sql injection violation, multi-statement not allow

Jfinal報錯：

com.jfinal.plugin.activerecord.ActiveRecordException: java.sql.SQLException: sql injection violation, multi-statement not allow 

 

public List<WarningFormDoc> findDocByPatrolRecordId(String patrolRecordId){
   String sql="select * from warning_form_doc where PATROL_RECORD_ID = " + patrolRecordId;
   return WarningFormDoc.dao.find(sql);
}

改為：

public List<WarningFormDoc> findDocByPatrolRecordId(String patrolRecordId){
   String sql="select * from warning_form_doc where PATROL_RECORD_ID = ?";
   return WarningFormDoc.dao.find(sql, patrolRecordId);
}

原因可能存在sql注入報錯；