dao持久层定义sql语句拼接参数之string和stringbuffer区别