Parameter index out of range (4 > number of parameters,which

Parameter index out of range (4 > number of parameters,which is 3).
public class UserDAOImpl implements IUserDAO {
\x05private Connection conn = null ;
\x05private PreparedStatement pstmt = null ;
\x05public UserDAOImpl(Connection conn){
\x05\x05this.conn = conn ;
\x05}
\x05
\x05
\x05public User select(String username,String password) throws Exception {
\x05\x05// TODO Auto-generated method stub
\x05\x05User user = null ;
\x05\x05String sql = "SELECT * FROM userinfo WHERE username=?and password=?" ;
\x05\x05this.pstmt = this.conn.prepareStatement(sql) ;
\x05\x05this.pstmt.setString(1,username) ;
\x05\x05this.pstmt.setString(2,password);
\x05\x05ResultSet rs = this.pstmt.executeQuery() ;
\x05\x05if(rs.next()){
\x05\x05\x05System.out.println("ok");
\x05\x05\x05user = new User() ;
\x05\x05\x05user.setUserid(rs.getInt(1));
\x05\x05\x05user.setUsername(rs.getString(2));
\x05\x05\x05
\x05\x05\x05user.setRealname(rs.getString(4));
\x05\x05\x05user.setRoletype(rs.getInt(5));
\x05\x05\x05user.setUserstate(rs.getInt(6));
\x05\x05\x05user.setDesc(rs.getString(7));
\x05\x05}
\x05\x05this.pstmt.close() ;
\x05\x05return user ;
\x05}
\x05
\x05public int userInsert(String username,String password,int roletype) throws Exception
\x05{
\x05\x05String insertCondition = "INSERT INTO userinfo VALUES (null,,,)" ;
\x05\x05this.pstmt = this.conn.prepareStatement(insertCondition) ;
\x05\x05this.pstmt.setString(1,username);
\x05\x05this.pstmt.setString(2,password);
\x05\x05//this.pstmt.setString(3,realname);
\x05\x05this.pstmt.setInt(4,roletype);
\x05\x05//this.pstmt.setInt(5,0);
\x05\x05//this.pstmt.setString(6,desc);
\x05\x05int n = this.pstmt.executeUpdate();
\x05\x05this.pstmt.close() ;
\x05\x05return n;
\x05}
\x05
}