String sql= "select * from users where username=? and password=?;

        PreparedStatement preState = conn.prepareStatement(sql);

        preState.setString(1, userName);

        preState.setString(2, password);

        ResultSet rs = preState.executeQuery();

    public static String SQL(String str)

    {

        return str.replaceAll(".*([';]+|(--)+).*", " ");

    }

    userName=SQL(userName);

    password=SQL(password);

    String sql="select * from users where username='"+userName+"' and password='"+password+"' "

    Statement sta = conn.createStatement();

    ResultSet rs = sta.executeQuery(sql);