SQL query built by concatenating input into a Statement execution call allows SQL injection.
Use PreparedStatement with parameterized queries instead of concatenating input into SQL strings.