Authenticating the username, password by using filters in Java (contacting with database)

The following is the piece of Java code by using filters that shows the error page at every time if the username and password is also correct. Please help me, I don't have much knowledge on this concept.

String sql="select * from reg where username='"+user+"' and pass='"+pwd+"'";
rs=st.executeQuery(sql);
if(rs.next())
{
    chain.doFilter(request,response);
}
else
    sc.getRequestDispatcher("/error.html").forward(request,response);