title: How to escape user-supplied parameters with a SQL query?
body: <p>Trying to get started with JDBC (using Jetty + MySQL). I'm not sure how to escape user-supplied parameters in a SQL statement. Example:</p>
  
  <pre><code>String username = getDangerousValueFromUser();
  Statement stmt = conn.createStatement();
  stmt.execute("some statement where username = '" + username + "'"));
  </code></pre>
  
  <p>How do we escape "username" before use with a statement?</p>