Question: I know that the only really correct way to protect SQL queries against SQL injection in Java is using PreparedStatements.

However, such a statement requires that the basic structure (selected attributes, joined tables, the structure of the WHERE condition) will not vary.

I have here a JSP application that contains a search form with about a dozen fields. But the user does not have to fill in all of them - just the one he needs. Thus my WHERE condition is different every time.

What should I do to still prevent SQL injection?  

Escape the user-supplied values? Write a wrapper class that builds a PreparedStatement each time? Or something else?

The database is PostgreSQL 8.4, but I would prefer a general solution.

Thanks a lot in advance.

Answer: 
The best solution is to use a middle that does data validation and binding and acts as an intermediary between the JSP and the database. 

There might be a list of column names, but it's finite and countable. Let the JSP worry about making the user's selection known to the middle tier; let the middle tier bind and validate before sending it on to the database.
I'm not confident if there is a quote() method, which was widely used in PHP's PDO. This would allow you a more flexible query building approach.

Also, one of the possible ideas could be creating special class, which would process filter criterias and would save into a stack all placeholders and their values.