code: public List<User> find(Connection conn, String str, Criteria criteria) throws SQLException {
          ResultSetHandler<List<User>> h = new BeanListHandler<User>(User.class);
          String sql = "\n";
          if (str !=null && !str.trim().isEmpty()) {
              sql = "WHERE username||fullname ~ '"+str+"' \n";
          }
  
          if (criteria != null && criteria.getLimit() >0) {
              ResultSetHandler<Long> scalar = new ScalarHandler<Long>(1);
              String totalSql = "SELECT COUNT(id) FROM userbase \n"+sql;
              int total = ((Long)run.query(conn, totalSql, scalar)).intValue();
              criteria.setTotal(total);
          }
  
          sql =
              "SELECT id,username,fullname,type,emailaddress,registered_ts,invited_by,enabled \n"+
              "FROM userbase \n"+sql;
  
          sql = SQLBuilder.getSortClause(sql,criteria);
          sql = SQLBuilder.getPagingClause(sql,criteria);
          return run.query(conn, sql, h);
      }
docs: {@inheritDoc}
  <p>
  安全考虑，返回 List 中所有 User 的 password 属性为 null。</p>