How to use a variable in preparedstatement for sql query?

Question

I am doing a web-application project in eclipse Java EE. Currently, my application returns all values in the database which stores personal information of employees. However, I

Answer 1

You need to use parameters in your prepared statement, e.g. as follows:

PreparedStatement ps = con.prepareStatement("select ... where employeeID = ?");
ps.setInt(1, 1234);

Or with a named parameter:

PreparedStatement ps = con.prepareStatement("select ... where employeeID = :employeeId");
ps.setInt("employeeId", 1234);