因为系统多处复杂查询的sql拼接，根据不同查询情况需要传递不同的参数，导致SQL 注入【严重】,请问这个情况有解决的办法吗？急急急！！！！

sql.append("select a.*,b.id deptid,org_name,province,city,area,street from zf_law_plan1 a,safe_org b where a.zf_deptid=b.id and func_status=1 ");
					if("0".equals(person)) {
						if(month!=null) {
							sql.append(" and plan_year like '%-"+month+"%' ");
						}
						if(year!=null) {
							sql.append(" and plan_year like '%"+year+"-%' ");
						}
					}else if("1".equals(person)) {
						sql.append(" and yearorperson = '"+personValue+"' ");
					}
					sql.append(" and zdspr = '"+Sess.getUser("id")+"' ");
					sql.append(" order by timestamp desc ");