Dangerous piece of code on www.datatables.net/development/server-side/jsp

Hello,

Please see the code on http://www.datatables.net/development/server-side/jsp
I think this code is vulnerable to sql injections. A warning would be in place.
What is your opinion?

Chris