判断用户登录，空值异常

判断用户登录，空值错误，在线等
实现中： 

Java code

    @Override    public boolean isLogin(String username, String password) {                boolean flag=false;        String hql="select u.username,u.password from User u where u.username='"+username+"' and u.password='"+password+"'";        System.out.println(username);        System.out.println(password);        List<User> list=hibernateTemplate.find(hql,new Object[]{username,password});        if(list.size()>0 ){            flag=true;        }        return flag;    }

Java code

    @Test    public void testIsLogin(){        UserDaoImpl obj=new UserDaoImpl();        obj.isLogin("a","a");    }