ACR - Java - SQL Injection

gistfile1.java

// Insecure code
String query = "SELECT account_balance FROM user_data WHERE user_name = " + request.getParameter("customerName");
ResultSet results = statement.executeQuery( query );

// Defense using prepared statements
String custname = request.getParameter("customerName"); // This should REALLY be validated too
// perform input validation to detect attacks
String query = "SELECT account_balance FROM user_data WHERE user_name = ? ";

PreparedStatement pstmt = connection.prepareStatement( query );
pstmt.setString( 1, custname); 
ResultSet results = pstmt.executeQuery( );