When I code JDBC I am creating and executing SQL
        
        However if I use an untrested string in my SQL
        
        for example:
        I have web apge, with a form asking the user to enter:
        UserID:
        Password:
        
        and I write this SQL:
        SELECT * FROM USERS WHERE UserID = "data from from"
         ANd Password = "data from form"
         
       and the USer enters:
       UserID: root --
       Password:

       and I end up with this SQL:
       SELECT * FROM USERS WHERE UserID = root --  <- in SQL -- mean ignore the rest of the command
         ANd Password = "data from form"
         
      This is SQL Injection Attack, and only works if you take untrusted strings into
      your dynamic SQL