I need to execute in a Java application a `SET schema ?` statement, where the placeholder is replaced by a value provided at runtime by the caller.

I assumed I could use `PreparedStatement` to overcome potential SQL injection, but if I try to execute a prepared statement I get a `PSQLException` with message 

```
ERROR: syntax error at or near "$1"  Position: 18

```

If I do execute the SQL by just concatenating the schema name by doing:

```
public void executeSetSchema(Connection con, String schema){
  try{
     Statement stmt = con.createStatement();
     stmt.execute("SET SCHEMA '" + schema + "'");

  } catch(Exception){}
}

```

Then everything works as expected.

Clearly, this happens with all the latest releases of PostgreSQL

Why I cannot use a PreparedStatement and what should I do instead to prevent SQL injection here?