SQL injection

Statement s = c.createStatement();

ResultSet r = s.executeQuery( "Select * from users where name = '" + request.getParameter("Name") + "' AND password = '" + request.getParameter("Password") + "'";