This SQL statement might be subject to an "SQL Injection" attack.

http://en.wikipedia.org/wiki/SQL_injection

We should use PreparedStatements instead.