If you remove the WHERE from the query, it won't know which record to update. And the PreparedStatement needs '?' to work in the query. As far the author field, try a new approach.
Write a class that has methods that update or do other staff with the database, and after you have tested it, use it in your .jsp. You shouldn't have too much logic in jsp files. Just html and calling methods. You shouldn't write preparedStatements and other long code calculations.
A small example of updating the db from a .jsp. (I am not saying that this will work for you)
<%
//get the parameters from the request and store them in variables
String someVariable = request.getParameter("someVariable");
//probably check the values for errors
SomeClass sc = new SomeClass();
sc.updateMethod(.......);
%>
Inside the SomeClass you should implement and TEST your queries.