title: How to avoid SQL injection
body: <p>I have a tool which points out all the sql injection issues and I found one as follows :</p>
  
  <p>"SELECT GB.BTN,GUP.CUST_USERNAME,GUP.EMAIL from GBS_BTN GB,GBS_USER_BTN GUB,GBS_USER_PROFILE GUP WHERE GB.BTN=GUB.BTN AND GUB.CUST_UID=GUP.CUST_UID AND GB.ET_ID='" + strAccountID + "' ORDER BY CREATE_DATE DESC",oCin"</p>
  
  <p>can some please tell me how to construct the above query to avoid sql injection?</p>