SQL inject detected in login.jsp

[p0l42]

I detected a sql inject in login.jsp by source code review. In detail, the code in teacherD/studentD.checkAccount concat the username and password with sql, and cause a sql inject. The vuln can be exploit by payload 1' or '1'='1 and access main.jsp successfully without true password.