Is this piece of code SQL Injection safe?
<p>Does this prevent SQL injection or do I have to pass the parameter with <code>preparedStatement.setString()</code></p>

<pre><code>String sqlQuery = "select st from master where st_id= %1s ";

sqlQuery = String.format(sqlQuery, id);
preparedStatement = conn.prepareStatement(sqlQuery);
rs = preparedStatement.executeQuery();
</code></pre>

<p>This is not a code review, the code above is an example for the question.</p>