Jdbc prevents SQL Injection-PreparedStatement

Public List getUserByName (String name, String password ){
ResultSet rs = null;
PreparedStatement stat = null;
Connection conn = null;
List list = new ArrayList ();
Try {
Conn = createConnection ();

String SQL = "select name, password from manager where name =? And password =? ";
Stat = conn. prepareStatement (SQL );
Stat. setString (1, name );
Stat. setString (2, password );
Rs = stat.exe cuteQuery (SQL );
While (rs. next ()){
System. out. println (rs. getString (1 ));
String [] user = new String [2];
User [0] = rs. getString (1 );
User [1] = rs. getString (2 );
List. add (user );
}
} Catch (Exception e ){
E. printStackTrace ();
} Finally {
CloseAll (rs, stat, conn );
}
Return list;
}