I am developing java code where sql query is already, but it it leads to sql injection, I am using setString method to avoid sql injection. But the setstring is adding single quotes for parameter values, so my query is failing. How can I remove single quotes for setString methods.

I have tried to use replaceAll method, but it does not work for preapred statements.

```
String X="where IP ?";

String Y=" group by user";

String Z="order by descend";

query="select appname,user,IP from xyz "+X+" "+Y+Z; --> this is existing query.

```

I am changing query as below

```
query="select appname,user,IP from xyz ? ? ?"; 

Object=connectionObj.prepareStatement(query);

Object.setString(1,X);

Object.setString(2,Y);

Object.setString(3,Z);

```

but here setString method is adding single quoes for the values so my query is failing as syntax error.I tried `replceAll("'"," ")` method but it only works for strings not for prepared statements.I am stuck with syntax error.Please help me out to solve this issue in JAVA.