Password protecting pages

A working example from GetNewUser, needs improving :
1. Look up the session information, if the session table is empty then redirect to the login page.

String getIt   =  "SELECT user from sessions where session = '"+session.getId()+"'";
stmt = conn.createStatement();
rs = stmt.executeQuery(getIt);
 
if (    rs.next() ) {
USERNAME = rs.getString("user") ;
out.println("Your username is : "+USERNAME);
int length = USERNAME.length();
                          }
else    response.sendRedirect("login.jsp");

In jsp this is how I do it :

String ff = session.getId();
String myUrl = "emailformServlet.jsp";
CheckSessionId  qq = new CheckSessionId();
String ab=qq.checkIt(ff,myUrl);
if ( ab.length() < 3) response.sendRedirect("https://barkus.bold.ac.uk/userregister/login.jsp");
String cc = " is loggged in";