Normally my advice would be to use a PreparedStatement when you want to deal with dates in the database. You did that, but you completely missed the point of PreparedStatement, which is that you can put "parameters" in the query and have the database driver deal with formatting them in the right way. So your query should look like this:
Notice that you don't have to worry about quoting or not quoting parameters, nor do you have to worry about formatting date parameters. Just call the appropriate setXXX methods of PreparedStatement.
The one thing you have to deal with is that
JDBC wants a java.sql.Date but you have a java.util.Date. Or at least, you will have one after you convert your text string into one. Here's how to get a java.sql.Date from a java.util.Date: