use prepared statement instead of string interpolation

server/src/main/java/io/druid/db/DatabaseRuleManager.java

@@ -74,13 +74,15 @@ public class DatabaseRuleManager
             @Override
             public Void withHandle(Handle handle) throws Exception
             {
-              List<Map<String, Object>> existing = handle.select(
+              List<Map<String, Object>> existing = handle
+                  .createQuery(
                       String.format(
-                      "SELECT id from %s where datasource='%s';",
-                      ruleTable,
-                      defaultTier
+                          "SELECT id from %s where datasource=:dataSource;",
+                          ruleTable
                       )
-              );
+                  )
+                  .bind("dataSource", defaultTier)
+                  .list();
 
               if (!existing.isEmpty()) {
                 return null;