It's not correct. It leaves the sql nulled and results with an exception later on when calling executeStatement. You must prevent executing the sql as well.