Use PreparedStatement.

Use the format

	String SQL = "Update Employees SET age = ? WHERE id = ?";
   	pstmt = conn.prepareStatement(SQL);

   	// Bind values into the parameters.
	stmt.setInt(1, 35); // This would set age
	stmt.setInt(2, 102); // This would set ID

	// Let us update age of the record with ID = 102;
	int rows = stmt.executeUpdate();

And as well, use methods of PreparedStatement:
	boolean execute(String SQL)
	int executeUpdate(String SQL)
	ResultSet executeQuery(String SQL)