No What I meant was using the JDBC prepared statement. here an example:

Help with Code Tags

JSP Syntax (Toggle Plain Text)

String[] vals = request.getParameterValues("checkbox");
try {
  PreparedStatement pStmt = conn.prepareStatement("Insert into table (field) values (?)");
  for (String val : vals) {
    pStmt.setString(1, val);
    pStmt.execute();
  }
} catch .....

String[] vals = request.getParameterValues("checkbox"); try { PreparedStatement pStmt = conn.prepareStatement("Insert into table (field) values (?)"); for (String val : vals) { pStmt.setString(1, val); pStmt.execute(); } } catch .....

of course replacing checkbox, table, and field with the real things.