Java : SQL injection: parameter tampering

The application executes an SQL query using a parameter received from the user without additional filtering. An attacker could gain access to information about other users. With such a direct request for information, for example, by bank account number, an attacker can steal confidential information (for example, a bank account balance) using a direct link to the object.