If you were using OpenACS, this would have been done for you automatically via the support for "bind variables".

As you are doing things in Java (at least I assume so since you mention Tomcat), you will have to figure out how to set bind variables in Java.