You should be using PreparedStatement's for inserting data into your database. Here is the PreparedStatement example from the J2SE 1.4.2 API specification:
PreparedStatement pstmt = con.prepareStatement("UPDATE EMPLOYEES SET SALARY = ? WHERE ID = ?");
pstmt.setBigDecimal(1, 153833.00)
pstmt.setInt(2, 110592)
See how the SQL values are supplied outside of the statement's definition? Doing this ensures that the parameters you're inserting are properly escaped, and more importantly, that they don't inject user-supplied SQL into your database. (SQL injections can drop your database tables or retrieve database rows that you never intended!)
Jon Emerson
http://www.jonemerson.net/