java - SQL Injection and possible attacks -

hi have following query part of java class. want know possible attacks possible sql injection. how attacker can inject queries? sample queries in case can used gain access database?

    string query = ("select username, password, admin users      "  + "username='" + username + "' , password='" +      password + "'");      resultset rs = st.executequery(query);      // entry in result set means query successful ,      //the user valid user     if (rs.next()) {      username = rs.getstring(1);      isadmin = rs.getboolean(3);    

i think possible way of attack putting username abc';# since after # considered comment in sql. others think it?

i want know attacker entering in username box , password box of html page gain access administrator. assuming job of above java class process request of users's input html page querying database.

basically works https://xkcd.com/327/

what assuming, user inputs threat, save variables ususername, "us" means unsafe. after check every "us"-variable injections, results in susername (s means safe). when build query can use s-varaibles , should safe in cases.

this idea totally taken here: http://www.joelonsoftware.com/articles/wrong.html