This week's book giveaway is in the OO, Patterns, UML and Refactoring forum. We're giving away four copies of Refactoring for Software Design Smells: Managing Technical Debt and have Girish Suryanarayana, Ganesh Samarthyam & Tushar Sharma on-line! See this thread for details.
my guess on the invalid character would be the ';'
Try removing that and see if it works.
Having said that though, running sql queries through a JSP is not the best approach.
Using JSTL is better than using scriptlets, I'll grant you that, but even in the JSTL specification they state that these tags should only be used from demos and small projects.
You would be better off writing a data access layer in java.