Concurrency and thread-safety are big subjects that can't be dealt with appropriately in a forum post. I suggest you start reading the
Sun Java Tutorial on that subject.
Fundamentally, you need to guard access to
shared, mutable state (and I realize that you may not understand what that means before you dig deeper into the subject).
Shared means anything that can be accessed from more than a single
thread - in a web app, that would by servlet instance variables, session contents, context parameters, amongst other things.
Mutable means that the value can change. It's no problem to have shared data if its value never changes (maybe initialization parameters). But anything that can have its value/data changed is a problem.
Any read or write access to shared, mutable state -which also includes databases and files- needs to be protected through one of the various means described in the tutorial, e.g. synchronization.