Dealing with single quotes in a dynamic query I'm building a query as a string in my application layer to be executed over jdbc. 

The string is constructed as follows:

"SELECT COUNT(DISTINCT ROOT_ID) as rows1 FROM DANIEL.UNIQUE_PHYSICIAN "
                + "WHERE "
                + "UNIQUE_PHYSICIAN.SOURCE_TABLE = 'STI.PHYSICIAN' AND "
                + "UNIQUE_PHYSICIAN.FIRST_NAME = '"
                + firstP.getFirstName()
                + "' AND "
                + "UNIQUE_PHYSICIAN.LAST_NAME = '"
                + firstP.getLastName()
                + "' AND "
                + "UNIQUE_PHYSICIAN.POSTAL_CODE = '"
                + firstP.getPostalCode() + "'";


This works fine, until we hit a doctor in our database containing a single quote, such as "JEANNE-D'ARC" as her first name. It turns the query into the following:

SELECT COUNT(DISTINCT ROOT_ID) as rows1 
FROM DANIEL.UNIQUE_PHYSICIAN 
WHERE UNIQUE_PHYSICIAN.SOURCE_TABLE = 'STI.PHYSICIAN' 
AND UNIQUE_PHYSICIAN.FIRST_NAME = 'JEANNE-D'ARC' 
AND UNIQUE_PHYSICIAN.LAST_NAME = 'ANON' 
AND UNIQUE_PHYSICIAN.POSTAL_CODE = 'AAA AAA'


How can we resolve this?

EDIT: as I understand it, I should be using parameters as something. This query is going into a program and we can't necessarily control what doctor's names come in, so I guess this is a SQL injection vulnerability, right?
You can escape single quotes by using 2 single quotes, that way your query would work. I'm not sure about the java syntax for a replace but your query should look something like this

SELECT COUNT(DISTINCT ROOT_ID) as rows1 
FROM DANIEL.UNIQUE_PHYSICIAN 
WHERE UNIQUE_PHYSICIAN.SOURCE_TABLE = 'STI.PHYSICIAN' 
AND UNIQUE_PHYSICIAN.FIRST_NAME = 'JEANNE-D''ARC' 
AND UNIQUE_PHYSICIAN.LAST_NAME = 'ANON' 
AND UNIQUE_PHYSICIAN.POSTAL_CODE = 'AAA AAA'


instead of this

SELECT COUNT(DISTINCT ROOT_ID) as rows1 
FROM DANIEL.UNIQUE_PHYSICIAN 
WHERE UNIQUE_PHYSICIAN.SOURCE_TABLE = 'STI.PHYSICIAN' 
AND UNIQUE_PHYSICIAN.FIRST_NAME = 'JEANNE-D'ARC' 
AND UNIQUE_PHYSICIAN.LAST_NAME = 'ANON' 
AND UNIQUE_PHYSICIAN.POSTAL_CODE = 'AAA AAA'


In any case, as has been suggested parametrized queries or stored procedures should be investigated (again, i'm not sure how to parametrize queries in java) .

You should also be very careful about SQL injection, what happens for example if someone enters a name "';drop table patients;--" ? Suppose the line breaks are not sent to SQL as I would expect from your example you get this:

SELECT COUNT(DISTINCT ROOT_ID) as rows1 
FROM DANIEL.UNIQUE_PHYSICIAN 
WHERE UNIQUE_PHYSICIAN.SOURCE_TABLE = 'STI.PHYSICIAN' 
AND UNIQUE_PHYSICIAN.FIRST_NAME = ''; drop table patients;--ARC'     AND UNIQUE_PHYSICIAN.LAST_NAME = 'ANON'     AND UNIQUE_PHYSICIAN.POSTAL_CODE = 'AAA AAA'


OWASP is a good resource on security and has a resource on Java SQL injection and prepared statements here

From that page: 


  Prepared Statements
  
  Variables passed as arguments to prepared statements will
  automatically be escaped by the JDBC driver.
  
  Example: ps.1


String selectStatement = "SELECT * FROM User WHERE userId = ? ";
PreparedStatement prepStmt = con.prepareStatement(selectStatement);
prepStmt.setString(1, userId);
ResultSet rs = prepStmt.executeQuery();