Java SQL有关问题 求教高手

Java SQL问题 求教高手
insert into HBL_TRACKING_HIS(HBL_NO,MBL_NO,CREATE_DATE,CONTAINER_NO,STATUS,EXECUTE_DATE) VALUES('SD126100','574672794',to_date('2011-08-26 17:10:32','yyyy-MM-dd HH24:mi:ss'),(select container_no from JOB_SE_CNTR_DETAIL WHERE CONTAINER_ID = '1187106' ) ,'Arrive Destination Date',to_date('2011-08-01','yyyy-MM-dd HH24:mi:ss' ))

SQL Error:update tacking date -->ORA-00933: SQL 命令未正确结束

for(int y=0;y<6;y++){
insertSQL.append(" insert into HBL_TRACKING_HIS(HBL_NO,MBL_NO,CREATE_DATE,CONTAINER_NO,STATUS,EXECUTE_DATE) VALUES('"+JOB_NO+"','"+MBL_NO+"',to_date('" + format.format(now) + "','yyyy-MM-dd HH24:mi:ss')");
insertSQL.append(",(select container_no from JOB_SE_CNTR_DETAIL WHERE CONTAINER_ID = '"+Container_ID+"' ) ");
insertSQL.append(",'" + tracingDate[y][0] + "'"); 
insertSQL.append(",to_date('" + tracingDate[y][1] + "','yyyy-MM-dd HH24:mi:ss' ))");
 
String inTracing = insertSQL.toString();
  stmt1.executeUpdate(inTracing);
  System.out.print(insertSQL); 
}

------解决方案--------------------
这样拼字符串容易出错。
用prepareStatement,然后用setInt,setString,
这样还可以防止SQL注入