jsp連結資料庫問題

jsp連結資料庫問題

在上個網頁我有傳表單至這個網頁 name=passwd 我需要
將passwd更新 資料庫table = account  在欄位為 account底下為xml的資料
以下是我的JSP
我資料庫為account 欄位有 account passwd name student
為何無法執行有錯誤

<%@ page contentType="text/html; charset=Big5"
import="java.sql.*"%>
<HTML>
<HEAD>
<meta http-equiv="content-type" content="text/html; charset=big5">
<TITLE> </TITLE>
</HEAD>
<BODY>
<CENTER>
<FONT SIZE = 5 COLOR = blue>寫入資料庫 </FONT>
</CENTER>
<HR>
<CENTER>


<%
request.setCharacterEncoding("big5");
String passwd = request.getParameter("passwd");
Class.forName("com.mysql.jdbc.Driver").newInstance();
Connection conn= DriverManager.getConnection("jdbc:mysql://localhost:3306/projectgis?useUnicode=true&characterEncoding=big5","root", "");
String sql="update account set passwd="+passwd+" where account= xml";
PreparedStatement pstmt=conn.prepareStatement(sql);
pstmt.execute();
pstmt.close();
%>


<form method="POST" name="form2" action="connect.jsp">
<p> <input type="submit" name="formbutton3" value="回到資料查詢"> </p>
</form>
</CENTER>
</BODY>
</HTML>

該如何修改才能更新我要的值還有update 與 inset serlect該如何表示
exception

org.apache.jasper.JasperException: An exception occurred processing JSP page /correct_w.jsp at line 24

root cause
javax.servlet.ServletException: com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: Unknown column 'xml' in 'where clause'
org.apache.jasper.runtime.PageContextImpl.doHandlePageException(PageContextImpl.java:852)
org.apache.jasper.runtime.PageContextImpl.handlePageException(PageContextImpl.java:781)
org.apache.jsp.correct_005fw_jsp._jspService(correct_005fw_jsp.java:93)
org.apache.jasper.runtime.HttpJspBase.service(HttpJspBase.java:70)
javax.servlet.http.HttpServlet.service(HttpServlet.java:717)
org.apache.jasper.servlet.JspServletWrapper.service(JspServletWrapper.java:374)
org.apache.jasper.servlet.JspServlet.serviceJspFile(JspServlet.java:342)
org.apache.jasper.servlet.JspServlet.service(JspServlet.java:267)
javax.servlet.http.HttpServlet.service(HttpServlet.java:717)


root cause

com.mysql.jdbc.exceptions.MySQLSyntaxErrorException: Unknown column 'xml' in 'where clause'
在sqlserver里xml是一个 系统的关键字  你写的那个xml应该要用 ''单引号包起来把
String sql = "……  account= 'xml'";
这样呢
这个是你字段类型的问题
不论是什么数据库只要是字符串都要用单引号引起来
String sql="update account set passwd='"+passwd+"' where account= 'xml'";