I’m using sqlite-jdbc. I understand using prepared statement can help prevent insertion attack. For a simple query as following, prepared statement can be used

public void insert(String name, double capacity) {  
        String sql = "INSERT INTO employees(name, capacity) VALUES(?,?)";  
   
        try{  
            Connection conn = this.connect();  
            PreparedStatement pstmt = conn.prepareStatement(sql);  
            pstmt.setString(1, name);  
            pstmt.setDouble(2, capacity);  
            pstmt.executeUpdate();  
        } catch (SQLException e) {  
            System.out.println(e.getMessage());  
        }  
    }

However, I have a query that reads as

“SELECT from employees(name, capacity) WHERE name in (name1, name2, name3…)”

where names are of variable length. How can I use prepared statement to prevent insertion attack?