SQL Inject Found in one_page_student

[p0l42]

I found a sql inject in one_page_student.findWithId/findWithName. Set a breakpoint as follows: When I use payload one_page_student?key=1' or '1'='1，it hits the breakpoint. After executing String sql=...， sql becomes After executing sql query, al is filled with information