String  author=request.getParameter("author").trim();
String  bookname=request.getParameter("bookname").trim();
String bookSelect="";
String authorSelect="";
if(bookname.compareTo("")!=0){ 
nameSelect="bookname='"+bookname+"'";}
if(author.compareTo("")!=0) {
authorSelect="author='"+author+"'";}
byte[] tmpbyte=bookSelect.getBytes("ISO8859_1");
bookSelect=new String(tmpbyte);
tmpbyte=authorSelect.getBytes("ISO8859_1");
authorSelect=new String(tmpbyte);
if(authorSelect.compareTo("")!=0&&nameSelect.compareTo("")!=0) nameSelect="and"+nameSelect;
String sql="select pid from book where";
sql=sql+authorSelect+nameSelect+"order by pid desc";

String author = new String(request.getParameter("author").trim().getBytes("ISO8859_1"), "GB2312");
String bookname=new String(request.getParameter("bookname").trim().getBytes("ISO8859_1"), "GB2312");

String authSQL = null;
String nameSQL = null;
boolean flag=true;

if(author == null || author.equals("")) {
   authSQL = "";
   flag=false;
} else {
   authSQL = "author='" + author + "'";
   flag=true;
}

if(bookname == null || bookname.equals("")) {
   bookname = "";
} else {
   if(flag) bookname = "and bookname='" + bookname + "'";
   else bookname = "bookname='" + bookname + "'";
}

String sql = "select pid from book where";
sql = sql + authSQL + nameSQL;