Preventing SQL Injection in DAO Layer

[Ravi Kiran Va]

Assume that we have data inside the DTOObject

public void loginUser(UserDTO)
{

String name = UserDTO.getName();
String pwd = UserDTO.getPassword();
String sql  = "select UNAME , PWD from LoginTable where uname='"+name+"' and PWD='"+pwd+"';
}

My question is how to check for things like 1='1' in the SQL ??

Please tell me in this code , how can we prevent SQL Injection ?? How can we check for Malicious characters ??

[Jeanne Boyarsky]

Ravi,
You don't want to screen for malicious characters. You want the driver to do it for you. If you use a SQL statement with binding variables as:
String sql = "select UNAME , PWD from LoginTable where uname=? and PWD=?"

and a PreparedStatement, the SQL is safe. Even if a user enters 1=1 for the uname or pwd, it will be treated as a value. Since the value doesn't match any field, the query returns zero records.