Java สอบถามปัญหาคำสั่ง SQL เกี่ยวกับการใส่ input ลงในคำสั่ง executeQuery

rs = stmt.executeQuery("SELECT distinct a.i_docno, a.i_company, a.i_project, a.i_lock, a.d_keyin, c.i_house  FROM lan:serv_dochd a, lan:serv_docdt b, lan:acxlckmd c where c.i_company = a.i_company and c.i_project = a.i_project and c.i_lock = a.i_lock and b.i_docno = a.i_docno and c.i_company = '" + comp + "' and c.i_project = '" + proj + "' and a.f_status = 'OPN' and a.i_doc_type = 'J' and b.f_itmstatus = '200' order by a.i_docno ");