sql in jsp error

[shruthi.kashiprasad]

String sql = ("SELECT sid,serial# FROM v$session WHERE USERNAME="+username+"AND MACHINE="+machine+";") ;

I want to get sid and serial no from username and machine using v$session for enabling trace using jsp
For this statement i'm getting error:
Error: java.sql.SQLException: ORA-00933: SQL command not properly ended
Pls help me out! I'm new to all this so put it in layman terms

[Tolls]

Use a PreparedStatement and bind (using getXXXX() methods) those variables in.
You shouldn't concatenate your SQL together like that except in (usually rare) circumstances.