Password protecting pages

A working example from GetNewUser, needs improving :
1. Look up the session information

String getIt   =  "SELECT user from sessions where session = '"+session.getId()+"'";
stmt = conn.createStatement();
rs = stmt.executeQuery(getIt);
 
if (    rs.next() ) {
USERNAME = rs.getString("user") ;
out.println("Your username is : "+USERNAME);
int length = USERNAME.length();
                          }
else    response.sendRedirect("login.jsp");