I want avoid SQL injection problem using the concatenation.

在这里，我想展示这个条件查询，以避免sql注入。

String matchName = helper.trim(request.getParameter("txtName"));
            if (StringUtils.isNotBlank(matchName)) {
                if (searchCondition.length() > 0)
                    searchCondition.append(" AND ");
                searchCondition.append("PROV_NM_1_TXT LIKE '" + "%"
                        + matchName.toUpperCase() + "%" + "'");

            }

            String matchBusinessName = helper.trim(request
                    .getParameter("txtBusName"));

            if (StringUtils.isNotBlank(matchBusinessName)) {
                if (searchCondition.length() > 0)
                    searchCondition.append(" AND ");
                searchCondition.append("PROV_NM_1_TXT LIKE '" + "%"
                        + matchBusinessName.toUpperCase() + "%" + "'");
            }

            String matchLicense = helper.trim(request

            .getParameter("txtLicenseNumber"));
    if (StringUtils.isNotBlank(matchLicense)) {
        if (searchCondition.length() > 0)
            searchCondition.append(" AND ");
                searchCondition.append("LCNS_NBR='" + matchLicense + "'");
            }

上面的条件我想在查询中呈现