The code below uses Statement.


<pre class="brush: java"> 
 String city = request.getParameter ("city");
 String state = request.getParameter ("state");
 
 String query = "select * from records where city='"+ 
 city +"' and state='" + state +"'";

 try (Statement statement = connection.createStatement (); 
 Resultset result = statement.executeQuery (query)) {
 // more code
 }
 catch (SQLException e) {}
</pre>



The above code is unsafe due to the fact that values of city and/or state can be altered to include control characters without any further checks. Inserting an apostrophe (') for example in one or both values could result in an error and transactions will be stopped and will not complete.



A Safer alternative way to the above code is to use PreparedStatement.



<pre class="brush: java">
 String city = request.getParameter ("city");
 String state = request.getParameter ("state");

 String query = "SELECT * FROM records where city = ? and state = ?";

 try (PreparedStatement statement = connection.prepareStatement (query)) {
 statement.setString(1, city);
 statement.setString(2, state);

 if (statement.execute()) {
 // more code
 }
 }
 catch (SQLException e) {} 
</pre>




Good luck.

A safer way to code SQL queries in Java