String str = (String)session.getAttribute("UserName");
String q = "insert into Data (UserName, Marks) values ('"+str+"' , "+count+")";
System.out.println(q);

Connection con = null;
String url = "jdbc:mysql://localhost:3306/";
String db = "jdbctutorial";
String driver = "com.mysql.jdbc.Driver";
try {
    Class.forName(driver);
    con = DriverManager.getConnection(url + db, "root", "root");
    try {
        String str = (String)session.getAttribute("UserName");
        String q =
            "insert into Data (UserName, Marks) values ('" + str +
            "' , " + count + ")";
        Statement st = con.createStatement();
        int val = st.executeUpdate(q);
        System.out.println("Marks added.");
    } catch (SQLException s) {
        System.out.println("SQL statement is not executed!");
    }

}

String sql = "INSERT into Data VALUES(?,?)";
  PreparedStatement prest = con.prepareStatement(sql);
  prest.setString(1, str);
  prest.setInt(2, count);
  ps.executeUpdate();
  System.out.println("Marks added.");
  con.close();