Best way of avoiding SQL injection?

Question

Hey,
I was wondering what you guys would recommend to prevent SQL injections. Now, I know that you can use the PreparedStatement and setString for cases like this:
String userName  = request.getParameter("username");
String sqlString = "SELECT * FROM UserTable WHERE USERNAME='" + userName ;but what can you do when you have cases like these:
String userdef_table  = request.getParameter("userdef_table");
String userName  = request.getParameter("username");
String sqlString = "SELECT * FROM "+ userdef_table +" WHERE USERNAME='" + userName ;Note: userdef_table can be created by the admin so I wont know what tables are around.
thanks,
domet

Answer 1

For Your First Question
1) using PreparedStatement is the best way, but yes you will have to catch the Table Not Found Exception very well in case the passed table deso not exist... Thats The Only Logical Answer For your Query
For Your Second Query
1) Create a String variable which will have the required reflex string ie the text you would liketo have after LIKE keyword and then pass the variable to the prepare statement
this
?% will not work for its wrong SQL query
String likeThis = "%Bill%"; <or what ever>
the Query part will be like this ".......like ?"
setString(....,likeThis);
Hope This Works
Bhaskar