sql = "select * from MOVIES where n_flag=? and v_name like ?"; PreparedStatement pst=conn.prepareStatement(sql); pst.setInt(1, flag); pst.setString(2, "%" + v_name + "%");