Findbug issue -The code creates an SQL prepared statement from a nonconstant String

[kanag janak]

My program has the following code.The findbug is showing a the following bug.
The code creates an SQL prepared statement from a nonconstant String. If unchecked, tainted data from a user is used in building this String, SQL injection could be used to make the prepared statement do something unexpected and undesirable.

   PreparedStatement getTheStatement(Connection connection, final String statements) throws SQLException {

        return connection.prepareStatement(statements);
    } 
 

Can anyone help me to fix this.

thanks

[Paul Sturrock]

If you have methods that take SQL as a parameter, SQL injection is possible. You will know how exposed this method is; can a client call it with their own SQL?