Hi I'm trying to write a piece of code for a simple verification method as part of a MVC.

At present the SQL is not written as a prepared statement so obviously it is at risk to a SQL injection so any help in regards to writing the SQL as a prepared statement would be really helpful.

The method which is in the User model.

public boolean getLoginInfo() {

    try {
        DBAccess dbAccess = new DBAccess();

        String sql = "SELECT username, password FROM owner WHERE username = '" + this.username
                + "'AND password = '" + this.password + "';";

        dbAccess.close();dbAccess.executeQuery(sql);
        dbAccess.close();


        return true;
    } catch (Exception e) {
        return false;
    }
}

I want to get the size of the result set which is generated by the SQL query and if the size of it is 1 return true else it's false.

If you need more info on the rest of the MVC just post and I'll get it up here.