jsp without SQL injection prevention