How good is to form a Query on the client

[laxmikant shimpi]

I have a Question that
I am using JSP-Servlet-RequestProcessor-Bean-DAO (Data Access Object) - dB architecture.
We are building an Enterprise Application to be accessed by the users of an Intranet site.
We are bulding all the queries in side the JSP itself resulting the security threat to our application (as I feel it is)
What are the various ways to send the data to the Servlet to that servlet can use the information and constrcut the Queries ?
Is it good to design JSPs for building the SQL Queries (Insert, Update, Delete) ?
I would appreciate the response.
Laxmikant
SCJP

[chanoch wiggers]

isnt it the responsibility of the DAO objects to form the queries? If you have DAO objects that are not responsible for constructing the queries then you have a problem...
btw, I think it is safer to create prepared statements and then add the query details after wards if you want to protect against SQL injection.