SQL inject detected in login.jsp

[p0l42]

I detected a sql inject in login.jsp by source code review.
In detail, the code in teacherD/studentD.checkAccount concat the username and password with sql, and cause a sql inject.

The vuln can be exploit by payload 1' or '1'='1 and access main.jsp successfully without true password.