title: Prevent SQL injection attacks in a Java program
body: <p>I have to add a statement to my java program to update a database table:</p>
  
  <pre><code>String insert =
      "INSERT INTO customer(name,address,email) VALUES('" + name + "','" + addre + "','" + email + "');";
  </code></pre>
  
  <p>I heard that this can be exploited through an SQL injection like:</p>
  
  <pre><code>DROP TABLE customer; 
  </code></pre>
  
  <p>My program has a Java GUI and all name, address and email values are retrieved from <code>Jtextfields</code>. I want to know how the following code (<code>DROP TABLE customer;</code>) could be added to my insert statement by a hacker and how I can prevent this.</p>